mo-exchange[.]com

The domain mo-exchange.com is presently active and returns an HTTP 200 response code, indicating that a web server is reachable. DNS queries resolve to the authoritative nameservers ns1.zomro.net and ns2.zomro.ru, which belong to the Zomro hosting infrastructure. Registration data shows the domain was created through the registrar Sollutium EU sp. z o.o., a European registrar that is frequently observed in malicious registrations.

VirusTotal analysis reports that 15 of 91 scanning engines flag the domain as malicious, providing a moderate detection consensus across independent security vendors. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, both of which reinforce the classification of the site as abusive. The threat type is listed as generic phishing and the risk level is rated high.

No additional intelligence such as page title, targeted brand, or phishing kit has been disclosed, leaving the exact content of the hosted page unknown and the specific credential‑harvesting technique uncertain. Defenders should treat mo-exchange.com as hostile: block DNS resolution for the domain, add it to local and network‑level blocklists, and monitor outbound traffic for connections to the Zomro nameservers. Email filtering rules should be updated to flag any messages containing references to mo‑exchange.com, and security teams should periodically re‑evaluate the indicator as the infrastructure may evolve, but current evidence supports immediate mitigation.