mozdesign[.]com[.]br

Analysis of mozdesign.com.br shows active credential phishing infrastructure targeting Google users. The domain resolves to IP 162.241.203.81, which is geolocated in Brazil and belongs to ASN 31898 (Oracle Corporation). The host runs Apache HTTP Server and serves jQuery libraries, and presents a TLS certificate from Let’s Encrypt (R12). The site returns HTTP 403 for direct requests, but the page title "Sign in – Google Accounts" indicates a classic Google login clone designed to harvest credentials.\n\nThe domain was registered on 14 February 2019 through the registrar NEWFOLD and uses HostGator Brazil name servers (ns1000.hostgator.com.br, ns1001.hostgator.com.br). Reputation checks show a Gridinsoft trust score of 0 out of 100, and VirusTotal flags the domain by five of ninety‑five security vendors. The domain is currently listed on one public blocklist and has been blocked by the PhishDestroy mitigation service.\n\nInfrastructure signals suggest a low‑cost hosting environment, with the email MX record pointing to mail.mozdesign.com.br, indicating the operator may also handle outbound spam or phishing delivery from the same domain. The lack of additional observable services beyond the web server leaves the full scope of the campaign uncertain; however, the presence of a Google‑like login page combined with the high‑risk classification confirms a targeted credential theft attempt.\n\nDefenders should prioritize blocking the domain and its associated IP address at network perimeter devices, update URL filtering rules to include mozdesign.com.br, and monitor for any outbound connections to the same IP range. Incident response teams should also inspect logs for traffic to the domain and consider enforcing multi‑factor authentication for Google accounts to mitigate potential compromise. Continuous threat‑intel feeds should be queried for any related indicators that may surface as the campaign evolves.