plusnet[.]co[.]mz

The domain plusnet.co.mz was registered on 21 February 2026 through the CIUEM Registrar and is currently hosted on an IPv6 address 2a02:4780:84:4220:9d80:b8d:99c3:a825 belonging to AS47583 Hostinger International Limited, geographically located in Japan. Authoritative nameservers are ns1‑ns4.easyhost.co.mz, indicating reliance on the Easyhost service. The site presents an HTTP 403 response and the page title returned is “404 Not Found”, while the underlying web server identifies as LiteSpeed with HTTP/3 enabled. A Let’s Encrypt R13 certificate secures the connection, but the certificate alone does not mitigate the observed malicious behavior.

Malware scanning on VirusTotal shows that three of ninety‑three AV engines have flagged the domain, and the domain appears on a single external blocklist. Gridinsoft assigns a trust score of zero out of one hundred, and the domain is actively blocked by the PhishDestroy service. MX records consist of a single entry pointing to plusnet.co.mz with priority zero, which may be used for credential harvesting. The combination of recent registration, low trust score, AV detections, and blocklist presence supports a high‑risk classification for generic phishing.

However, the limited public visibility of the landing page and lack of additional threat‑intel sources leave some uncertainty about the exact phishing campaign or targeted brand. Defenders should add plusnet.co.mz to URL filtering and email security policies, monitor DNS queries for the listed nameservers, and enforce TLS inspection to capture any credential submissions. Continuous re‑evaluation is advised as further intelligence becomes available.