# wrs24.shop — SUSPICIOUS

> wrs24.shop is actively hosting a deceptive retail phishing scam. Flagged by 1 of 95 security vendors. Check the full report.

## Summary
PhishDestroy identifies wrs24.shop as an active phishing domain impersonating a legitimate retail brand to harvest payment credentials. This domain is currently engaged in fraudulent activities designed to deceive users into entering sensitive financial information under false pretenses. The threat is classified as elevated due to the active status of the domain and the specific intent to mimic a trusted retail entity for malicious gain.

Security intelligence confirms that wrs24.shop has been flagged by 1 out of 95 VirusTotal vendors, indicating limited but present detection of its malicious nature. The domain resolves to IP address 104.21.25.62 and utilizes a Google Trust Services SSL certificate, which may contribute to initial trust perception. While exact creation date and registrar details remain unverified in this assessment, the presence of a legitimate-issued SSL certificate underscores the importance of verifying domain legitimacy through additional security protocols. No blocklist count data is available at this time.

As of the latest analysis, wrs24.shop remains active and poses a credible threat to unsuspecting users. It is strongly recommended that users avoid interacting with this domain and refrain from entering any personal or financial information. Organizations and individuals are advised to block this domain at the network level and update their threat intelligence feeds to include this indicator. For a comprehensive analysis, including domain age, WHOIS details, and additional IOCs, refer to the full threat report.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: REGISTRAR_NOT_FOUND
- IP: 104.21.25.62

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/5b507a66-c550-4ebd-8b21-497881589d33
- PhishDestroy: https://phishdestroy.io/domain/wrs24.shop/
- LLM endpoint: https://phishdestroy.io/domain/wrs24.shop/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/wrs24.shop/
Last updated: 2026-03-24