wshop24[.]biz

Analysis as of July 24, 2026 indicates that wshop24.biz is an active malicious infrastructure used for generic phishing. The domain was registered on August 12, 2015 through NiceNIC International Group Co., Limited and continues to resolve to the IPv4 address 91.206.71.66, which is hosted by Cloudflare (AS13335) in the Netherlands. DNS resolution is served by the Cloudflare name servers david.ns.cloudflare.com and dina.ns.cloudflare.com. The site presents an HTTP 200 response and delivers a page whose title is the Russian phrase “Вы не робот?” (“You are not a robot?”), a common tactic to evade automated analysis. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a legitimate certificate authority but offering no assurance of benign intent.

Threat intelligence shows that 4 of 91 security vendors on VirusTotal have flagged the domain, and it appears on one public blocklist. PhishDestroy has also listed the domain as blocked. Reputation scoring from Gridinsoft assigns a score of 0 out of 100, indicating extreme distrust. The only technology observed is Cloudflare, which provides CDN and DDoS mitigation but does not obscure the malicious purpose.

Given the combination of a recent active status, flagged detections, low trust score, and the presence of a suspicious page title, defenders should treat wshop24.biz as a confirmed phishing site. Recommended mitigation steps include adding the domain to outbound web filtering rules, updating intrusion detection signatures, and, where possible, sinkholing the associated IP address. Continuous monitoring of DNS queries for the domain and its name servers is advised to detect any pivoting activity. Organizations should also share the indicator set with threat‑sharing communities to improve collective defenses.