mosrc24[.]biz

The domain mosrc24.biz has been flagged as a credential phishing site, specifically impersonating official mirrors of a platform or service under the title "MOSRC-Официальные зеркала." Analysis indicates the domain is currently offline, though it previously resolved to infrastructure associated with fraudulent activity. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 26, 2026, and resolved to the IP address 172.67.189.240. Despite its recent creation, the domain has not been flagged by any of the 95 vendors in VirusTotal's scanning engine. It holds a trust score of 0/100 according to Gridinsoft metrics and appears on a single security blocklist. The site employed Cloudflare and HTTP/3 technologies, with an SSL certificate issued by Let's Encrypt, which may have been leveraged to evade detection or lend an appearance of legitimacy. Current status confirms the domain has been taken offline, though historical indicators suggest potential for re-emergence under altered infrastructure. Organizations are advised to monitor for related domains registered through the same registrar or resolving to the IP 172.67.189.240. Network defenses should be updated to block access to mosrc24.biz and any subdomains, while end-users should be alerted to the presence of Russian-language phishing lures mimicking official service mirrors. Logs should be reviewed for prior connections to this domain to assess potential credential exposure.