mokshnow[.]com

Analysis indicates that mokshnow.com is an active phishing domain posing as an online store, currently flagged by multiple security sources. The domain was registered on April 28, 2026, and resolves to IP address 23.227.38.65, which is hosted by Shopify, Inc. in Canada. Infrastructure analysis reveals the use of Shopify’s e-commerce platform, Cloudflare for traffic routing, and HSTS enforcement, suggesting an attempt to appear legitimate. The domain’s nameservers (ares.trustname.com and zeus.trustname.com) are managed by Fewmoretaps OU, a registrar previously associated with low-reputation domains. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites, and does not inherently confirm trustworthiness. The domain is listed on one security blocklist and has been flagged by three of 91 security vendors in a recent scan. The page title, 'My Store,' is generic and does not disclose a specific brand target, though the use of Shopify infrastructure aligns with known phishing tactics where attackers create fraudulent storefronts to harvest payment details. The domain currently returns an HTTP 301 redirect, which may indicate an attempt to obscure its final destination or funnel traffic to a malicious endpoint. No confirmed victim reports or transaction logs are available at this time, so the exact nature of the scam remains unverified. Defenders should treat this domain as high-risk due to its recent registration, security vendor detections, and association with known phishing infrastructure. Network-level blocking is recommended, particularly for organizations handling financial or e-commerce transactions. Further investigation into the domain’s final landing page and any associated payment processing systems is advised to determine the full scope of the threat.