mostrosender[.]com

This domain, mostrosender.com, is confirmed to host a credential phishing portal designed to harvest user login credentials. Analysis of the page title, 'MostroSender - Login,' and associated infrastructure indicates a generic phishing campaign without explicit ties to a specific brand or crypto drainer kit. The site mimics a legitimate login interface, likely targeting users of financial, cryptocurrency, or email services to capture sensitive authentication details. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 199.217.98.200 and employs a Let's Encrypt SSL certificate, a common tactic to lend superficial legitimacy. Detection metrics show the domain is flagged by 3 out of 95 security vendors on VirusTotal, while appearing on two security blocklists, including PhishDestroy and OISD. The Gridinsoft trust score for this domain is 0/100, further corroborating its malicious nature. Technologies detected include Tailwind CSS for styling, Nginx as the web server, and HTTP/3 for enhanced performance, which may complicate detection and mitigation efforts. As of the latest assessment, mostrosender.com has been taken offline, likely in response to blocklist inclusions and security vendor detections. However, the elevated risk persists due to the domain's recent registration date, which suggests potential for re-deployment under a new infrastructure or altered domain name. Organizations and users are advised to treat any future iterations of this campaign with heightened scrutiny, particularly those leveraging similar registrar patterns or resolving to adjacent IP ranges. Proactive monitoring of newly registered domains under the same registrar may aid in early detection of related threats.