Domain security and threat intelligence

ljwew[.]shop

“LJ | Iniciar sesión”

Threat verdict High 56/100 evidence score

Availability Unverified Current reachability is unverified

Risk signals

VirusTotal detections: 2/94 Scam type: E-Commerce Scam

Mar 22, 2026

Evidence Summary

HIGH

Analysis of www.ljwew.shop indicates that the site was registered on March 22, 2026 through GNAME.COM PTE. LTD. and is currently taken offline. The domain resolves to IP address 47.88.27.229, which is hosted by Alibaba.com LLC in the United States. DNS resolution uses the nameservers a2.share-dns.com and b2.share-dns.net.

The web server presents a Let's Encrypt R12 certificate and advertises HTTP Strict Transport Security (HSTS). Service detection shows Nginx as the web server and jQuery as a client‑side library. The page title returned during the last scan was "LJ | Iniciar sesión," consistent with the listed scam type of an e‑commerce credential harvest. VirusTotal scanned the domain and recorded 2 detections out of 94 security vendors, indicating that at least a small subset of scanners flagged the site as malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single public blocklist, specifically PhishDestroy.

The overall risk level is marked elevated, and the threat type is classified as generic phishing. While the site is offline, the combination of a low trust score, partial VirusTotal detections, and inclusion on a phishing‑specific blocklist suggests an active malicious infrastructure that may be re‑hosted or re‑activated. Defenders should continue to block the domain and its resolved IP, monitor the registrar and nameservers for any changes, and add the domain to internal blacklists. Ongoing telemetry on re‑appearance or related domains should be collected to inform broader phishing mitigation efforts.

VirusTotal

2 det.

URLScan

Report ↗

TLS Certificate

Let's Encrypt

Age

5 mo

Observed status

Unverified

DestroyList

Listed

Data coverage VirusTotal 2 / 94 URLQuery report stored — detailed verdict pending PhishStats checked — no match recorded OTX no community references CF Radar scan completed URLScan capture stored report URLScan verdict Analysis completed DNS blocks 14 checked — no blocks TLS valid certificate, 81d WHOIS 5 mo old Screenshot 2 captures · 2 sources Redirect chain not probed

Threat Response Pipeline

Discovery

Checks

Reports

Availability

9/11

Public Blocklist Status

Stored Capture

Screenshot of ljwew.shop — **URLScan capture**Capture time unavailable 2 / 2

View Full Size Source Report Wayback Download

Page Title

LJ | Iniciar sesión

TLS Certificate

Valid transport encryption · Issued by Let's Encrypt · valid for 81 days

Domain Intelligence

Domain

URLScan Verdict Analysis completed score 0 report ↗

Server / ASN nginx · AS45102 Alibaba (US) Technology Co., Ltd.

IP Reputation abuse score 0/100 0 reports checked Aug 13, 2026

Registrar GNAME.COM

(SG)

ICANN RegistryOfficial ICANN accredited-registrars →

WHOIS LookupICANN RDAP for ljwew.shop →

IP Address 47.88.27.229

Geo

Minkler, US

NetworkAS45102 · Alibaba.com LLC

Reverse IPviewdns.info → rapiddns.io →

RegistrationCreated Mar 22, 2026 (144d)

Elapsed Since First Report 30 days

What we count Raw elapsed time since the first stored abuse report. It is not a registrar response-time measurement. Latest observed status: Unverified.

What each report contains Stored outgoing-report records may reference evidence available at the time, such as vendor verdicts, registration data, hosting details, classifications, or screenshots. This page does not infer the exact payload delivered, receipt, acknowledgement, or action by a recipient.

Technical detailsDNS, SSL SANs, timestamps

First DetectedMar 22, 2026

IoC Extractionscanned Jul 29, 20260 wallet · 0 Telegram IoCs

Submitted URLhttps://www.ljwew.shop/register?… query redacted

Nameserversb2.share-dns.net

TLS Fingerprint

TLS Observationvalid from Mar 14, 2026scanned Mar 25, 2026

ICANN OVERSIGHT

Accreditation and RAA context

Registrar accreditation and DNS abuse obligations

For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.

Accreditation is a contract, not a safety certification.

RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.

Accreditation is a contract, not a safety seal. Verify ICANN fees Read RAA §3.18 PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight

Accountability draft Nothing is sent automatically.

Technologies · 3 identified

Nginx

Web servers Reverse proxies

High-performance HTTP server and reverse proxy, known for stability and low resource usage.

jQuery

JavaScript libraries

Fast, small JavaScript library simplifying HTML manipulation, event handling, and Ajax.

HSTS

Security

HTTP Strict Transport Security — forces browsers to use HTTPS connections only.

Detected via Cloudflare Radar · Wappalyzer engine

Report This Domain Submit evidence & help protect others

VirusTotal Analysis

2 / 94 security vendors flagged this domain

View on VT

Last analyzed 2026-07-18 22:45:01 UTC

alphaMountain.ai

SOCRadar

Site Performance Analysis

Google PageSpeed Insights — mobile performance audit of ljwew.shop · checked Mar 22, 2026

Needs Work

Performance

FCP

1.83s

First Contentful Paint

LCP

8.1s

Largest Contentful Paint

CLS

0.081

Cumulative Layout Shift

TBT

0ms

Total Blocking Time

3.62s

Speed Index

Evidence & External Reports

Security Analysis

URLScan Analyzed VirusTotal 2 det. ChainPatrol URLQuery Report stored Gridinsoft SSL Labs Stored TLS valid CF Radar Open report WOT ScamAdviser Blacklist Checker URLVoid Sucuri SiteCheck MDN Observatory

OSINT & Intelligence

Web-Check Full scan SOCRadar Dark web report LeakIX Leak search Shodan Censys ThreatFox Hudson Rock Sign-in search IntelX crt.sh Certs WHOIS Wayback

DNS & Network

nslookup.io DNS bgp.tools ASN/Route

SEO & Domain

SpyFu Moz DA/PA Ahrefs Backlinks Deep Analysis

Were You Affected by This Site?

If credentials were compromised, report immediately. Do not engage with recovery scammers.

If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.

FBI IC3

Report internet-enabled crime in the United States

Federal tips line1-800-CALL-FBI

Europol

Find the official reporting channel for your EU country

National police directory

Action Fraud

Report fraud and cybercrime in England, Wales and Northern Ireland

Contact centre0300 123 2040

PhishDestroy listing review Not a law-enforcement report

Domain Appeal

Request a review if you own this domain and believe the listing is incorrect

Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →

Report to Your Local Authorities

Select your country to get official cybercrime contacts, or create a complaint draft →.

97-country directory

Template-based draft • optional AI wording assistance requires separate consent Review and submit it yourself

Stay Informed, Stay Safe

Monitor live threats or contest this listing if you believe it's a false positive

Live Threat Feed Appeal This Listing

HTML · IFRAME

Embed This Report

Share this threat intelligence on your website or blog

embed.html

<iframe
  src="https://phishdestroy.io/embed/domain/ljwew.shop"
  title="PhishDestroy threat report for ljwew.shop"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>

ljwew[.]shop

Threat Response Pipeline

Public Blocklist Status

Stored Capture