mokka[.]pages[.]dev

Analysis of mokka.pages.dev shows a newly registered domain (created 25 April 2026) that is actively serving HTTP 200 responses over Cloudflare’s network (IP 188.114.96.3, nameservers nikon.ns.cloudflare.com and tia.ns.cloudflare.com). The site presents a valid TLS certificate issued by Google Trust Services under the WE1 root, and enforces HSTS while supporting HTTP/3. Detected front‑end libraries include Bootstrap, indicating a typical web‑application stack. The page title returned by the server is "Mokka Voting", and the domain is classified as a generic credential‑phishing site. Infrastructure signals reinforce the malicious classification: Gridinsoft assigns a trust score of 0 / 100, the domain is listed on a security blocklist, and PhishDestroy has already blocked it. No further content analysis is available, so the exact phishing lure or target brand cannot be confirmed beyond the generic label. Defenders should treat the domain as hostile, enforce network‑level blocking, add the IP and domain to URL filtering and threat‑intel feeds, and monitor for any new associated indicators such as similar subdomains or payloads. Continuous observation is advised because the investigation status remains under review and the site may evolve its tactics.