shoppermacy[.]com

The domain shoppermacy.com was observed on July 12, 2026 and is classified as a generic phishing campaign targeting users with counterfeit e‑commerce pages. The domain was created on April 28, 2026 and is currently active, returning HTTP 403 for direct requests, which suggests that the front‑end content is likely served only to specific user agents or after a redirect. Infrastructure analysis shows that shoppermacy.com resolves to IP 172.67.198.206, an address associated with a content delivery network located in Canada. The authoritative name servers are marvin.ns.cloudflare.com and wren.ns.cloudflare.com, confirming the use of the CDN’s DNS service. The TLS certificate presented by the site is signed by a widely trusted public certificate authority, featuring the “Google Trust Services / WE1” issuer chain, which helps the site appear legitimate to browsers. Threat intelligence sources record the domain on a single security blocklist and in one AlienVault OTX pulse. It is also listed as blocked by a dedicated anti‑phishing filtering platform and receives a trust score of 0 out of 100 from a reputation engine. VirusTotal scans have resulted in three out of ninety‑five security vendors flagging the domain, indicating partial detection across the ecosystem. Analysis indicates that the campaign is in early stages, given the recent registration date and modest detection counts. Open questions remain about the specific phishing kit employed and the extent of victim targeting, as no payload hashes or landing page screenshots are available. Defenders should add the domain to outbound URL filtering rules, monitor DNS queries for the associated IP and name servers, and enforce TLS inspection to capture any concealed malicious payloads. Continuous re‑evaluation is advised as additional detections may emerge.