shopgotk365[.]top

This domain, shopgotk365.top, is flagged as a generic phishing site with an elevated risk level, specifically impersonating SoftEther VPN infrastructure. Analysis indicates the page title explicitly mimics legitimate SoftEther VPN Server interfaces, suggesting an attempt to deceive users into submitting login credentials or installing malicious configurations. No direct association with known drainer kits or cryptocurrency scams has been observed, but the domain aligns with credential harvesting tactics targeting remote access tools. Infrastructure analysis reveals the domain was registered on December 29, 2025, through Dominet (HK) Limited, resolving to IP 8.216.39.39 hosted on AS45102 (Alibaba (US) Technology Co., Ltd.) in Japan. The SSL certificate, issued by TrustAsia Technologies, Inc. under LiteSSL RSA CA 2025, appears valid but does not mitigate the phishing risk. Detection metrics show 18 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on one additional blocklist. Google Safe Browsing status is not explicitly provided, but the domain’s inclusion in PhishDestroy’s blocklist corroborates its malicious classification. As of the latest assessment, shopgotk365.top has been taken offline, reducing immediate exposure risks. However, the domain’s recent creation date and rapid detection by security vendors suggest it may have been part of a larger, short-lived campaign. Remaining risks include potential reuse of the infrastructure or registration of similar domains under the same registrar. Organizations and users are advised to monitor for related indicators of compromise, including the IP address 8.216.39.39 and SSL certificate thumbprints associated with TrustAsia-issued certificates. Proactive blocking of the domain and its resolved IP is recommended for network-level defenses.