madera-sa[.]com

Analysis of the domain madera-sa.com shows an active high‑risk generic_phishing operation. The domain was registered on February 21 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to 162.222.225.212, an IP address hosted in the United States under AS46606 (Unified Layer). Infrastructure fingerprints reveal an Nginx web server and a Let’s Encrypt R13 TLS certificate. The site returns HTTP 403 for the root request and presents the page title "madera-sa.com"; no further content has been publicly disclosed. Threat intelligence sources note inclusion in 13 AlienVault OTX pulses and blocking by PhishDestroy and PhishingDB, while Gridinsoft assigns a trust score of 0/100. VirusTotal scans report 16 of 95 security vendors flagging the domain, and the domain appears on two external blocklists. Uncertainty remains regarding the exact phishing payload or credential‑capture mechanisms, as no page content analysis is available. Defenders should add madera-sa.com and its associated IP 162.222.225.212 to blocklists, monitor DNS queries for the listed nameservers (ns1.cp-45.webhostbox.net, ns2.cp-45.webhostbox.net), and consider sinkholing traffic to mitigate potential credential harvesting. Continuous re‑validation against threat feeds is advised to capture any evolution of the campaign.