mrzlab[.]pro

Analysis of mrzlab.pro indicates an active generic phishing infrastructure. The domain resolves to 95.216.241.186, a Hetzner-DC host located in Finland, and returns HTTP 200 responses over a valid Let's Encrypt certificate (YR1). DNS is served by ns3.my-ndns.com and ns4.my-ndns.com, and registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. Threat intelligence sources have recorded the domain in twelve AlienVault OTX pulses and five of ninety‑one VirusTotal scanners have flagged it, suggesting a modest but notable detection history. It is presently listed on one public blocklist and is already blocked by the PhishDestroy service, confirming that security vendors recognize its malicious purpose. While the exact phishing lure (e.g., credential harvesting page) has not been publicly disclosed, the combination of active hosting, HTTPS support, and repeated vendor detections strongly supports a high‑risk classification. Defenders should add mrzlab.pro to network deny lists, enforce TLS inspection to capture any credential submission, and monitor DNS queries for the associated nameservers. Continuous re‑scanning of the domain's web content is advised to capture any payload changes, and any observed traffic to the IP address should be routed to a sinkhole for further forensic analysis.