mov[.]appcore-protocols[.]cc

Analysis of mov.appcore-protocols.cc indicates that the domain is currently active and has been associated with generic phishing campaigns aimed at harvesting user credentials. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy threat‑remediation service, confirming that at least one reputable sinkhole has identified it as malicious. VirusTotal scans show that nine out of ninety‑one security vendors have flagged the domain, providing independent corroboration of its malicious status.

No additional intelligence such as registrar details, hosting IP, SSL certificate data, or Safe Browsing verdicts is available in the current dataset, leaving the broader infrastructure of the operation uncharacterised. Defenders should treat any traffic to or from mov.appcore-protocols.cc as suspicious and consider blocking the domain at perimeter firewalls, DNS resolvers, and endpoint protection systems.

Continuous monitoring of threat‑intel feeds for new indicators—such as additional blocklist listings, changes in detection ratios, or emerging host associations—is recommended to capture any expansion of the underlying campaign. Organizations that rely on credential‑based authentication should reinforce multi‑factor authentication and educate users about unsolicited login prompts, as these remain the primary defence against credential‑harvesting phishing attempts.