scoorpioncc[.]store

This domain, scoorpioncc.store, is flagged as a generic phishing site impersonating ScorpionCC, a known payment and cryptocurrency service platform. Analysis indicates the site was designed to mimic the legitimate ScorpionCC storefront, likely to harvest user credentials, payment details, or cryptocurrency wallet information. The page title explicitly references Scorpion-Shop, scorpioncc, scorpioncc store, and scorpioncc cc, reinforcing its targeting of users familiar with the brand. No specific drainer kit signatures were identified in available telemetry, but the domain aligns with common phishing infrastructure patterns. Infrastructure analysis reveals the following technical indicators: the domain was registered through INWX GmbH on October 15, 2025, and resolves to the IP address 91.240.20.27. VirusTotal detections show 3 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is referenced in four AlienVault OTX threat intelligence pulses. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. No Google Safe Browsing (GSB) hits were recorded at the time of analysis, though this may reflect delayed reporting rather than benign status. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. Response actions include its inclusion in PhishDestroy’s blocklist and monitoring by multiple threat intelligence platforms. Remaining risk is classified as elevated due to the domain’s recent registration, low detection rate, and association with a known phishing target. Organizations are advised to block the domain and IP at the network level, monitor for related indicators, and alert users to potential credential exposure if interaction occurred prior to takedown.