alldiscount[.]shop

The domain alldiscount.shop was created on July 08, 2025 and remains active as of the report date, July 12, 2026. It is assigned a high risk level and is categorized under brand impersonation, specifically targeting the WordPress ecosystem. The site responds with HTTP status code 200 and the page title returned matches the domain string, indicating a deliberate attempt to appear legitimate.

Infrastructure analysis shows the domain resolves to IP address 92.113.16.34, which is announced by AS47583 belonging to Hostinger International Limited and geolocated to Germany. The hosting environment utilizes a Let's Encrypt R12 certificate, confirming TLS encryption is in place. Nameservers are ns1.dns-parking.com and ns2.dns-parking.com, both indicative of a parking service. Detected technologies include WordPress, MySQL, PHP, and the Hostinger CDN with HTTP/3 support, confirming a typical web‑application stack.

Reputation metrics are uniformly low: Gridinsoft assigns a trust score of 0 / 100, while Scamadviser rates the domain at 15 / 100. The domain appears on two security blocklists—PhishDestroy and ScamSniffer—and has been flagged by six of ninety‑five VirusTotal scanners, reinforcing the malicious intent. The combination of a low trust rating, presence on multiple blocklists, and detection by several security vendors aligns with the observed impersonation behavior.

Defenders should prioritize blocking network traffic to 92.113.16.34 and adding alldiscount.shop to URL filtering policies. Continuous monitoring of the domain’s DNS records is advised, as the current nameservers suggest the possibility of rapid re‑registration or redirection. Given the active status and high risk classification, incident response teams should also consider deploying sinkhole techniques and updating threat‑intel feeds to include this indicator of compromise.