powereduseronline[.]shop

Analysis as of July 23, 2026 indicates that the domain powereduseronline.shop was registered on February 21, 2026 and is presently taken offline. The domain resolves to the IPv4 address 94.74.164.255, which belongs to the German AS212238 network operated by Datacamp Limited. Reputation checks show the domain appears on a single security blocklist and has been referenced in thirteen AlienVault OTX threat‑intel pulses, suggesting that it has been observed in multiple malicious campaigns. VirusTotal scans have resulted in fifteen of ninety‑three security vendors flagging the domain, reinforcing the suspicion of malicious intent.

The TLS certificate presented by the host is issued to facepunch.drop-special.com, a mismatch that further undermines the legitimacy of the service. PhishDestroy has actively blocked the domain, confirming its classification as a phishing resource. Because the site is offline, HTTP response codes and page content cannot be examined, and no Safe Browsing verdict or page title is available. The lack of observable page data limits the ability to attribute a specific brand or lure technique beyond the generic phishing label supplied in the intelligence feed.

Nonetheless, the convergence of blocklist presence, multiple OTX mentions, vendor detections, and certificate anomalies provides sufficient evidence for security teams to treat the domain as hostile. Defenders should continue to enforce DNS‑level blocking for powereduseronline.shop, monitor the associated IP address 94.74.164.255 for any future activation, and update proxy or web‑filter policies to deny TLS connections to the mismatched certificate facepunch.drop-special.com. Incident response teams should also review any recent logs for outbound connections to the domain or its IP, and consider adding the host to internal threat‑intel feeds. Ongoing observation of the AS212238 network is advised, as infrastructure reuse is common among phishing operators.