pasportov-mosk[.]com

Analysis of pasportov-mosk.com indicates an active phishing domain targeting government document credentials, registered on July 22, 2026. The domain resolves to IP address 188.137.178.202 and is currently operational, returning an HTTP 200 status. Infrastructure is hosted behind Cloudflare nameservers (dalary.ns.cloudflare.com and ken.ns.cloudflare.com), a common tactic to obscure hosting origin and evade takedowns. The registrar is NICENIC INTERNATIONAL GROUP CO., LIMITED, a provider frequently associated with high-risk domains due to lenient registration policies.

As of July 26, 2026, the domain appears on one security blocklist, though it remains unflagged by 91 vendors in a recent VirusTotal scan. The absence of detections does not confirm safety; phishing domains often evade initial detection during the early stages of deployment. The domain name, pasportov-mosk.com, suggests a focus on Russian government-issued passports or Moscow-based document services, though the exact content and targeted brand have not been confirmed through page analysis. Defenders should treat this domain as high-risk infrastructure.

Network-level blocking is recommended for organizations handling government, travel, or identity verification services. Monitoring for related domains using similar naming conventions (e.g., variations of 'pasport', 'passport', or 'mosk') is advised, as threat actors frequently rotate domains to sustain phishing campaigns. Further investigation into the IP address 188.137.178.202 may reveal additional malicious domains hosted on the same infrastructure. No SSL certificate details or phishing kit signatures are currently available for analysis.