greenshopp702[.]store

PhishDestroy identifies greenshopp702.store as a recently activated domain engaged in counterfeit e-commerce phishing. This storefront masquerades as a legitimate shopping portal to harvest payment card credentials and personal data from unsuspecting users. No specific brand or drainer kit has been linked to this campaign at this time, but the infrastructure closely mirrors high-volume Magecart-style operations observed since Q2 2024. Registrant anonymization and rapid DNS rotation suggest a lightweight, disposable deployment optimized for short-lived credential theft operations against online shoppers. The domain leverages minimalist HTML overlays injected into compromised checkout pages, capturing keystrokes and exfiltrating inputs to a backend collector hosted on the same IP range.

Technical indicators reveal a clean slate on detection platforms: VirusTotal shows zero detections across 95 engines as of last scan, with no AV signatures triggered. The domain resolves to 172.67.130.211 via Cloudflare, registered on June 3, 2024 through Namecheap Inc., with a Google Trust Services SSL certificate issued June 4, 2024. The domain has not yet been flagged by Google Safe Browsing (GSB) and remains absent from all major public blocklists including Spamhaus, Abuse.ch, and OpenPhish. WHOIS data is fully redacted, and the domain’s age (14 days) aligns with the high-risk window for newly observed phishing domains targeting holiday retail traffic.

Current status is active and under active monitoring. PhishDestroy assesses this domain poses elevated risk due to SSL-backed credibility and zero detections, enabling prolonged operation before takedown. Immediate remediation includes network-level blocking of 172.67.130.211 and domain-wide DNS sinkholing. Users are advised to avoid greenshopp702.store, inspect payment forms for external JavaScript references, and report any interaction via internal phishing channels. While the immediate threat is contained through proactive blocking, the operational lifespan of this domain may extend due to slow detection cycle, warranting heightened vigilance until full takedown is confirmed by hosting provider.