joylipop[.]com

The domain joylipop.com has been identified as a fake e-commerce phishing site designed to impersonate legitimate online retailers selling custom family gifts. Analysis indicates the site mimics product listings, including a "Custom Name - Wooden Bear Family Puzzle - Family Gift" page, to deceive visitors into entering payment details under false pretenses. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively targeting consumers seeking personalized gifts. Infrastructure analysis reveals the domain was registered on February 12, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 52.10.27.176 and employed technologies such as ShopBase and HSTS, alongside an SSL certificate issued by ZeroSSL GmbH. Security telemetry indicates the domain was flagged by 10 of 95 vendors on VirusTotal, while Gridinsoft assigned a trust score of 1/100. The domain also appeared on one security blocklist and was blocked by at least one anti-phishing service. The current offline status reduces immediate exposure, though the infrastructure remains a latent risk. Organizations and individuals are advised to treat any prior interactions with the domain as compromised, particularly if payment details were submitted. Network defenders should update blocklists to include the domain and its associated IP (52.10.27.176) to prevent future access attempts. Users who encountered the site are urged to monitor financial statements for unauthorized transactions and consider identity protection measures. Proactive monitoring of newly registered domains with similar characteristics (e.g., gift-themed product listings, ShopBase infrastructure) is recommended to mitigate related threats.