mail[.]os-urospredic[.]edu[.]rs

The domain mail.os-urospredic.edu.rs is currently active and classified as a high‑risk generic phishing infrastructure. Registration data shows the domain was created on February 21, 2026 and was registered through Astra Telekom d.o.o., using the authoritative nameservers ns7.astratelekom.com and ns8.astratelekom.com. DNS resolution points to the IPv4 address 194.106.162.40, which belongs to AS6700 owned by TELEKOM SRBIJA a.d. in Serbia.

HTTP requests to the host return a 302 redirect, and the presented TLS certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, indicating a valid‑looking SSL deployment. The page title observed on the site is "IceWarp WebClient," suggesting the backend service might be an IceWarp mail portal, though no further content analysis is available. VirusTotal scans have recorded 14 positive detections out of 93 security vendors, and the domain appears on one public blocklist. PhishDestroy has already blocked the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment.

While the exact phishing lure and target user interaction remain unverified, the combination of recent creation, authoritative hosting under a telecom ASN, active redirection, SSL issuance, and multiple vendor detections provides strong evidence of a malicious campaign. Defenders should proactively block the domain at perimeter filters, monitor for DNS queries to the associated IP and nameservers, and consider updating any URL reputation feeds with the observed indicators. Continuous tracking of the domain’s activity and any future content changes is recommended to maintain situational awareness.