gpshop[.]cc

On July 24, 2026, the domain gpshop.cc was observed hosting a generic phishing page that returned the HTTP title “Just a moment…”. The site was taken offline at the time of analysis, and the blocklist PhishDestroy already listed it as malicious. DNS resolution points to the IP address 188.114.96.3, which belongs to Cloudflare’s network (AS13335) and is located in the United States. The domain is served behind Cloudflare, with the nameservers kianchau.ns.cloudflare.com and marlowe.ns.cloudflare.com, and the connection negotiates HTTP/3.

The TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid, publicly trusted certificate despite the malicious intent. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the classification as high‑risk. VirusTotal scanned the host and recorded detections from 2 of 95 security vendors, and the domain appears on at least one external blocklist. Registration data shows the domain was created on 21 February 2026 and was registered through NiceNIC International Group Co., Limited.

No additional intelligence such as targeted brand or phishing kit was disclosed, and the page content beyond the title has not been captured. Defenders encountering traffic to gpshop.cc should block the domain at the network perimeter, update DNS filtering policies, and monitor for any residual connections to the associated IP address. Because the infrastructure relies on Cloudflare’s CDN, threat actors could potentially repoint the domain to a different backend; continuous re‑evaluation of the DNS record and associated IP reputation is recommended. Incident responders should also correlate this indicator with internal logs to identify possible credential harvesting attempts and advise affected users to change passwords if any credentials may have been submitted.