coup[.]vicarshop[.]com

Analysis of the domain coup.vicarshop.com indicates a brand‑impersonation campaign targeting the AliExpress marketplace. The domain was registered on 17 June 2025 through Dominet (HK) Limited and has been observed pointing to the IPv4 address 52.192.90.134, which resolves to Amazon Web Services in Japan (AS16509). The hosting infrastructure is comprised of three nameservers – harlee.ns.cloudflare.com, ns1.domainnamedns.com, ns2.domainnamedns.com, ns3.domainn – suggesting use of both Cloudflare and a third‑party DNS provider. No TLS certificate is presented, meaning connections are unencrypted.

The site’s sole visible page title is the Korean phrase “메인 화면”, and no further content has been captured. VirusTotal has recorded 13 detections out of 95 scanned engines, indicating that the majority of security vendors recognize the domain as malicious. The domain is currently taken offline and has been listed by the PhishDestroy blocklist, as well as appearing on at least one additional security blocklist. Reputation services assign extremely low trust scores, with Gridinsoft rating the site 0 / 100 and Scamadviser 1 / 100.

The combination of a recent registration, AWS hosting, lack of HTTPS, and multiple detections aligns with typical infrastructure used by brand‑impersonation actors. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as the page content has not been publicly archived. Defenders should continue to block the domain and its associated IP address, add the hostnames to internal DNS deny lists, and monitor for any resurgence of the domain or related sub‑domains. Ongoing threat‑intel feeds should be consulted for updates, and any user‑reported attempts to access the site should be escalated for forensic examination.