sharkapex[.]shop

Analysis of the domain sharkapex.shop indicates active credential phishing infrastructure. Registered on June 12, 2026, through Namecheap, Inc., the domain resolves to 104.21.39.171, an address associated with Cloudflare, Inc. in Canada. The domain is served by Cloudflare nameservers (alla.ns.cloudflare.com, julian.ns.cloudflare.com) and uses HTTP/3, a configuration commonly observed in phishing campaigns leveraging Cloudflare’s proxy services to obscure origin servers. The SSL certificate is issued by Let’s Encrypt (serial E7), a legitimate but frequently abused certificate authority in phishing operations. The domain is flagged by 6 of 91 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. AlienVault OTX records the domain in four threat intelligence pulses, suggesting prior malicious activity. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. The HTTP response code is 301, indicating a redirect, while the page title reads 'sharkapex.shop | 523: Origin is unreachable,' which may reflect a misconfigured or intentionally disabled origin server, a tactic used to evade detection while maintaining infrastructure readiness. No specific brand or service is named in the available data, and the exact phishing target remains unconfirmed. Defenders should treat this domain as active credential phishing infrastructure, block resolution at the DNS level, and monitor for connections to 104.21.39.171 or related Cloudflare-proxied endpoints. Further analysis of redirect chains or payload delivery mechanisms is recommended if the domain becomes fully operational.