mori[.]hostel[.]town

Analysis of the domain mori.hostel.town indicates that it resolves to the IP address 172.86.104.14, which is currently reachable and serves as the sole hosting endpoint observed. The domain is listed on a single security blocklist and has been flagged by 11 of 91 security vendors on VirusTotal, demonstrating a moderate detection consensus among scanning services. PhishDestroy has actively blocked the domain, confirming its classification as a phishing vector. Authoritative name server information is unavailable (NS_NOT_FOUND), preventing verification of registrar details or DNS‑based protections.

As of the report date, July 27 2026, the domain remains active and no evidence of takedown or sink‑hole activity has been reported. The existing intelligence does not provide a page title, SSL certificate details, HTTP response codes, or any Safe Browsing or OTX entries, leaving the site content uncharacterized beyond its generic phishing label. Consequently, the specific payload, credential‑stealing mechanisms, or targeted brands cannot be confirmed, and the lack of DNS records hinders attribution of the registrar or registration date. Defenders should prioritize blocking connections to 172.86.104.14 at the network perimeter and adding the domain to internal blocklists.

Email security gateways should be updated to flag URLs containing "mori.hostel.town". Continuous monitoring of VirusTotal and other multi‑engine scanning services is recommended to capture any changes in detection rates. Threat‑intel teams should query passive DNS and WHOIS sources to attempt recovery of registrar information, which may aid in takedown requests. Given the current detection profile, the domain should be treated as high‑risk and any user‑initiated traffic to it should be denied or sandboxed for further analysis.