moskwa-passport[.]com

The domain moskwa-passport.com has been identified as a credential theft and document fraud platform, specifically targeting individuals seeking forged Russian Federation passports with false database verification claims. Analysis confirms the domain is currently offline, though prior activity involved the sale of counterfeit identity documents under the guise of legitimate government services. This represents a direct threat to personal identity security and financial integrity, as victims may unknowingly provide sensitive information or payments to fraudulent actors. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusually future-dated registration likely intended to evade immediate detection. It resolved to the IP address 185.110.92.47 and was flagged by 7 of 95 security vendors on VirusTotal, with a presence on one external blocklist. AlienVault OTX recorded the domain in a single threat intelligence pulse, while Gridinsoft assigned a trust score of 0 out of 100. The page title, 'Купить паспорт РФ с проводкой по базе в Москве,' explicitly advertised the sale of Russian passports with purported database validation, a clear indicator of fraudulent intent. The domain’s current offline status does not eliminate the risk of resurgence or migration to alternative infrastructure. Organizations and individuals are advised to block the domain and associated IP 185.110.92.47 at the network perimeter. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure. End-users should be educated on recognizing document fraud schemes, particularly those leveraging official-sounding language or claims of government affiliation. If financial transactions were attempted, affected parties should report the incident to relevant authorities and financial institutions to mitigate potential fraud.