# PhishDestroy domain threat record: musordrop.store Content language: English Canonical HTML report: https://phishdestroy.io/domain/musordrop.store/ Machine-readable companion: https://phishdestroy.io/domain/musordrop.store/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-28 07:02:42 UTC - Last availability or vendor check: 2026-10-28 12:30:58 UTC - Stored record updated: 2026-10-28 12:30:58 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: steam ## Stored infrastructure - Observed IP address: 188.137.249.164 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Registrar country in stored WHOIS data: HK - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-09 09:59:19 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a18150-accb-74ab-9798-bd5e0224f298/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/musordrop.store - Certificate Transparency search: https://crt.sh/?q=%25.musordrop.store - Web Archive lookup: https://web.archive.org/web/*/https://musordrop.store/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified musordrop.store as malicious on 2026-10-28, citing a high‑confidence AI‑detected phishing pattern combined with the domain’s 48‑day age. The page title advertises Musor Drop promo codes, bonuses and a Steam trade link, and states that the “current domain” is musor.click with a link labeled “Open the actual site.” An HTTP 200 response was recorded for the domain on the same date. How the scam works Attackers host a replica site that pretends to be the legitimate Musor Drop service, lure visitors with promised promo codes or bonuses, and then forward them to another domain where login credentials or trade authorizations can be harvested. The scheme relies on brand impersonation and redirection to capture sensitive information. Evidence VirusTotal scanned the domain on 2026-10-28 with 92 engines and reported zero malicious and zero suspicious detections. Google Safe Browsing checked on 2026-10-28 and did not flag the site, and OTX listed no pulses as of that date. urlscan captured the page on 2026-10-28; its engine analysis marked it malicious with a score of 97, while the overall verdict was non‑malicious, and PhishDestroy’s internal blocklist recorded the domain as malicious on the same day. Infrastructure The domain was registered with NICENIC INTERNATIONAL GROUP CO., LIMITED on 2026-09-09, 49 days before first detection. It resolved to IP 188.137.249.164, belonging to the Podaon SIA network in the Netherlands, and served a Let’s Encrypt (YR2) certificate valid from 2026-09-09 to 2026-12-08. DNS records observed on 2026-10-28 listed Zomro name servers (ns1.zomro.net, ns2.zomro.ru, ns3.zomro.com, ns4.zomro.su) and MX entries for mail.musordrop.store. What to do Users should avoid entering any Musor Drop credentials or approving Steam trades on musordrop.store; if they have already done so, they should change the affected passwords and review account activity. Defenders should add musordrop.store to perimeter blocklists, monitor for connections to 188.137.249.164, and treat any login attempts to the site as potentially compromised. Review server logs for requests to the recorded IP and enforce a policy to block traffic to this exact address. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a18150-accb-74ab-9798-bd5e0224f298/ Cloudflare Radar report: https://radar.cloudflare.com/scan/01ff5ac2-8508-41bc-86bd-3ed397d56852 Stored capture screenshot: https://i.ibb.co/R4kDRrWm/e10518097411.png Cloudflare Radar screenshot (2026-10-28T07:03:16Z): https://screenshots.phishdestroy.io/cf/01ff5ac2-8508-41bc-86bd-3ed397d56852.png VirusTotal report: https://www.virustotal.com/gui/domain/musordrop.store Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=musordrop.store Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-28 07:04:28 UTC ## Stored page captures - Primary capture: https://i.ibb.co/R4kDRrWm/e10518097411.png Captured: 2026-10-28 07:02:42 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a18150-accb-74ab-9798-bd5e0224f298.png Captured: 2026-10-28 07:02:42 UTC Source report: https://urlscan.io/result/01a18150-accb-74ab-9798-bd5e0224f298/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/01ff5ac2-8508-41bc-86bd-3ed397d56852.png Captured: 2026-10-28 07:03:16 UTC Source report: https://radar.cloudflare.com/scan/01ff5ac2-8508-41bc-86bd-3ed397d56852 SHA-256: 6edb8158088678069354ad6b4628bca9dc03de5f0b576a87a6b40e3bc8e8d8a8 - URLQuery: https://screenshots.phishdestroy.io/uq/dc6f1713-b06e-4642-95be-9a01cada03ef.png Source report: https://urlquery.net/report/dc6f1713-b06e-4642-95be-9a01cada03ef SHA-256: 4d083ce4554d64956a895d6a1b8f144c914e312201a85509661f978f5fef8a68 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-28T07:03:31Z", "uuid": "01a18150-accb-74ab-9798-bd5e0224f298", "scanned_at": "2026-10-28T07:01:55Z", "final_url": "https://musordrop.store/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://musordrop.store/", "from": "http://musordrop.store/", "status": 307 } ], "ip": "188.137.249.164", "ptr": "188-137-249-164.netherlands-3.vps.ac", "ips": [ "188.137.249.164" ], "asns": [ "211381" ], "countries": [ "NL" ], "link_domains": [ "t.me" ], "social": [ "https://t.me/musordrop" ], "doc_hash": "f8fd08f03c50e19bb04596216ea86e804dc5db5af495a818202704c2f1d0289c", "script_hashes": [ "e8c218ef52616235d153256c08d9136b2d02b76c2a2682c9d97a258d86231b90", "2c752a401191671d5bbbe7514f5828bbb0a7cc50bfbe77ddaf1b1ccba4412ed2", "9dd3774e91a2ae89281a60e935888436feef6dd2bc7b7ce32688e73408c72bb3", "2d983c391d12729db1ec3244cf251e8677172ae9c7af76c2feb5f51d3c0c3aa7", "840736303219f937417096197dac45365c7394789ec3dbff2d21d829d168c8da", "a563cb521c2ecb73087724453299a11639c035e760159685b23c9949119454f1", "89b3b87c902b755d8ac3a5441724f3d01e41482df6e347e251fed8083290df83", "211405fa1cda6eeb0f775525c8bc55571dae9d7af4dc6c0394b03e6a6fe7c314" ], "globals": [ "webpackChunk_N_E", "__next_f", "next", "_N_E_STYLE_LOAD" ], "tls": { "san": [ "musordrop.store", "www.musordrop.store" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "musordrop.store", "protocol": "TLS 1.3", "valid_to": "2026-12-08T11:15:27Z", "valid_from": "2026-09-09T11:15:28Z" }, "domain_age_days": 56, "apex_age_days": 56, "tls_age_days": 48, "tls_valid_days": 89, "requests": 14, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=utf-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-28T07:03:34Z", "uuid": "01ff5ac2-8508-41bc-86bd-3ed397d56852", "scanned_at": "2026-10-28T07:03:16Z", "final_url": "https://musordrop.store/", "status": 200, "history": [ { "url": "https://musordrop.store/", "status": 200 } ], "dom_hash": "1bc14a0d51878979273e1886a66086e52736d1ab13c65ae34d0584ba90ce78e0", "doc_hash": "f8fd08f03c50e19bb04596216ea86e804dc5db5af495a818202704c2f1d0289c", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "musordrop.store", "type": "A", "value": "188.137.249.164" } ], "dnssec_valid": false, "ip": "127.0.1.22", "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-09-09T11:59:19Z", "updated": "2026-09-14T12:00:33Z", "expires": "2027-09-09T11:59:19Z", "nameservers": [ "ns1.zomro.net", "ns2.zomro.ru" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-28T07:03:12Z", "analysis_at": "2026-08-31T23:40:43Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "first_seen": "2026-08-31T22:35:24Z", "dns": [ { "ttl": 3600, "type": "NS", "value": "ns11.domaincontrol.com" }, { "ttl": 3600, "type": "NS", "value": "ns12.domaincontrol.com" }, { "ttl": 3600, "type": "A", "value": "13.248.243.5" }, { "ttl": 3600, "type": "SOA", "rname": "dns.jomax.net", "value": "ns11.domaincontrol.com" }, { "ttl": 3600, "type": "A", "value": "76.223.105.230" } ], "dns_at": "2026-08-31T23:40:45Z", "jarm": "29d29d00000000000041d41d000000dd5c266caaa8baaf93008418f7774284", "cert": { "san": [ "musordrop.store" ], "issuer": "GoDaddy.com / GoDaddy TLS Intermediate CA DV - R1v1", "serial": "837759180e397752", "sha256": "cbc7d258c0742c0ed55a948a4b7b1b8578fd31e69b20920310c66c429b8b6c37", "subject": "musordrop.store", "valid_to": "2027-03-17T22:07:06Z", "valid_from": "2026-08-31T22:07:06Z" }, "rdap": { "status": [ "client update prohibited", "client transfer prohibited", "client delete prohibited", "client renew prohibited", "add period" ], "events": { "expiration": "2028-08-31T21:59:30Z", "last changed": "2026-08-31T21:59:31Z", "registration": "2026-08-31T21:59:30Z", "last update of RDAP database": "2026-08-31T22:35:29Z" }, "registrar": "GoDaddy.com, LLC", "registrar_iana_id": "146" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-28T07:03:49Z", "mail_config": { "mx": [ "mail.musordrop.store" ], "spf_lookups": 0 }, "caa_records": { "domain": "musordrop.store" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-28T07:03:22Z", "first": "2026-10-28T07:03:22Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 19889 }, "robots_txt": { "present": true, "sitemaps": [ "https://musordrop.store/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 9 }, "social_tags": { "ogUrl": "https://musordrop.store/", "title": "Musor Drop сегодня — промокоды, бонусы и актуальные обновления", "ogType": "website", "robots": "index, follow, max-image-preview:large, max-snippet:-1", "ogTitle": "Musor Drop сегодня — промокоды, бонусы и актуальные обновления", "ogSiteName": "Musor Drop Radar", "themeColor": "#06080b", "description": "Musor Drop сегодня: что активно прямо сейчас — рабочие промокоды, бонусы, раздачи, статус сайта и текущий домен. Лента изменений с датами.", "twitterCard": "summary_large_image", "canonicalUrl": "https://musordrop.store/", "ogDescription": "Musor Drop сегодня: что активно прямо сейчас — рабочие промокоды, бонусы, раздачи, статус сайта и текущий домен. Лента изменений с датами." }, "trackers": { "requests": 11 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 20, "tls": 25, "wait": 15, "connect": 11, "download": 57 }, "response_ms": 128 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 25, 53, 80, 110, 143, 443, 587, 993, 995 ] }, "carbon": { "bytes": 142508, "co2_grams": 0.0052, "cleaner_than": 14 }, "dns_server": { "ns": [ { "ip": "116.202.0.200", "host": "ns4.zomro.su" }, { "ip": "185.82.216.129", "host": "ns2.zomro.ru" }, { "ip": "212.8.245.252", "host": "ns1.zomro.net" }, { "ip": "51.38.146.91", "host": "ns3.zomro.com" } ], "zone": "musordrop.store" }, "location": { "ip": "188.137.249.164", "asn": "211381", "org": "Podaon SIA", "city": "Oude Meer", "country": "NL" }, "ssl": { "issuer": "Let's Encrypt / YR2", "subject": "musordrop.store" }, "dns": { "A": [ "188.137.249.164" ], "MX": [ "{\"exchange\": \"mail.musordrop.store\", \"priority\": 10}", "{\"exchange\": \"mail.musordrop.store\", \"priority\": 20}" ], "NS": [ "ns1.zomro.net", "ns4.zomro.su", "ns2.zomro.ru", "ns3.zomro.com" ], "SOA": "{\"nsname\": \"ns1.zomro.net\", \"hostmaster\": \"support.zomro.com\", \"serial\": 2026090902, \"refresh\": 10800, \"retry\": 3600, \"expire\": 604800, \"minttl\": 86400}", "TXT": [ "yandex-verification: 09f84d1de09d6903", "google-site-verification=q9uTtx5AkSokmgFwItQrbWevS27FE2qUbbfBKpC9HJc" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "188.137.249.164", "family": 4 }, "redirects": { "chain": [ "https://musordrop.store" ] }, "linked_pages": { "external": [ "https://t.me/musordrop" ], "external_count": 1, "internal_count": 14 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-09-09T11:59:19Z", "updated": "2026-09-14T12:00:33Z", "expires": "2027-09-09T11:59:19Z", "status": [ "clientTransferProhibited https://icann.org/epp", "clientDeleteProhibited https://icann.org/epp" ], "nameservers": [ "ns1.zomro.net", "ns2.zomro.ru" ] }, "headers": { "headers": { "server": "nginx", "content-type": "text/html; charset=utf-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ```