moboshortw2a[.]com

This domain, moboshortw2a.com, is currently under investigation for generic_phishing activity targeting mobile payment portals. Analysis indicates the domain remains active and has not yet been flagged by security vendors, suggesting an early-stage campaign or evasion tactics. Infrastructure analysis reveals the domain was registered on September 23, 2024, through Amazon Registrar, Inc. and resolves to the IP address 3.251.5.140. As of the latest assessment, the domain has been flagged by 0 of 95 vendors on VirusTotal, indicating no prior detection or blocklisting. The SSL certificate is issued by Amazon, a common pattern observed in both legitimate and malicious infrastructure to avoid immediate suspicion. No historical blocklist entries or reputation scores are available, further suggesting the domain is either newly deployed or actively avoiding detection. Current status shows the domain remains operational, with no evidence of takedown or mitigation efforts. Organizations are advised to monitor network traffic for connections to 3.251.5.140 or the domain itself, particularly in contexts involving mobile payment workflows. Immediate steps include adding the domain and IP to internal blocklists, conducting retrospective log analysis for prior connections, and alerting end-users to potential phishing attempts. Given the lack of prior detections, this domain may represent a low-volume or targeted campaign, warranting heightened scrutiny for unusual payment-related communications.