findbestshop[.]cc

PhishDestroy identifies an active fake-store phishing operation orchestrated through the recently registered domain findbestshop.cc, which was created on December 25, 2022. The site masquerades as a legitimate shopping portal to harvest login credentials, payment cards, and personal data from bargain-seeking users. PhishDestroy has elevated the risk to elevated due to the presence of a live SSL certificate and the domain’s aggressive monetization tactics observed in the wild.

This domain was flagged by 4 of 95 VirusTotal security vendors and resolves to the IPv4 address 101.99.90.146. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar that has previously facilitated high-volume phishing infrastructure. The Let’s Encrypt SSL certificate adds superficial legitimacy, masking the site’s true intent. Historical checks against major blocklists reveal no prior detections, indicating it is a fresh campaign designed to evade legacy defenses.

To mitigate exposure, users should immediately block the domain findbestshop.cc and the underlying IP 101.99.90.146 at the network perimeter. Enterprises are advised to push an updated blocklist to endpoints and to inspect DNS logs for recent resolutions to this IP. Consumers should avoid clicking any links from unsolicited emails or social media posts promising deep discounts; instead, verify the retailer through official brand channels before entering payment details. PhishDestroy continues to track this campaign and will publish IOCs for downstream consumption.