mobilaktif[.]vip

Analysis of mobilaktif.vip indicates a high-risk phishing domain impersonating a mobile payment service, currently active as of July 24, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and is hosted on Cloudflare infrastructure (AS13335), resolving to IP 172.67.130.226 in the United States. The site employs Cloudflare nameservers (elijah.ns.cloudflare.com, kinsley.ns.cloudflare.com) and enforces HSTS, alongside detected technologies including Vue.js, jQuery, and HTTP/3, suggesting a modern, obfuscated frontend designed to evade detection. The domain is flagged by 3 of 95 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy.

Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. The SSL certificate, issued by Google Trust Services (WE1), is legitimate but does not mitigate the domain's fraudulent intent. An HTTP 302 redirect is observed, a common tactic to obscure the final phishing destination from automated scanners. The page title, mobilaktif.vip/h5/, implies a mobile-optimized interface, likely targeting users of financial or payment platforms, though the exact brand being impersonated remains unconfirmed due to limited content analysis.

Defenders should prioritize blocking this domain at DNS and network levels, particularly in environments handling financial transactions or mobile banking. The use of Cloudflare hosting and modern web technologies indicates an effort to blend with legitimate traffic, necessitating correlation with other indicators such as the IP, nameserver patterns, and SSL certificate details. Given the domain's recent registration and active malicious detections, it is likely part of an ongoing campaign. Further investigation into associated IPs, registrant details, and redirect chains is recommended to identify linked infrastructure.