naturiumstore[.]shop

The domain naturiumstore.shop is flagged as a high‑risk generic phishing site and remains active as of the report date 27 July 2026. Infrastructure analysis shows the domain resolves to the IPv4 address 80.71.144.122, which is hosted on a Cloudflare network indicated by its authoritative name servers konnor.ns.cloudflare.com and mariah.ns.cloudflare.com. Reputation services have placed the domain on one security blocklist, and the PhishDestroy service explicitly blocks it. VirusTotal scans have returned six positive detections out of ninety‑one scanned engines, confirming that multiple independent scanners identify malicious behavior.

No additional public indicators such as SSL certificate details, HTTP response codes, or page titles are currently available, limiting the ability to describe the exact phishing content hosted at the domain. The limited visibility suggests that the site may be using fast‑flux or temporary hosting techniques, but the static IP address points to a more stable infrastructure. Defenders should add the domain and its resolved IP address to outbound and inbound deny lists, monitor DNS queries for the associated Cloudflare name servers, and enforce URL filtering based on the known blocklist entry.

Continuous re‑scanning with VirusTotal or similar multi‑engine platforms is advised to capture any change in detection count. Because the domain is still active, organizations should treat any inbound traffic to naturiumstore.shop as potentially malicious and apply appropriate user awareness warnings. Further investigation is required to obtain the HTTP response, TLS certificate, and page content to fully characterize the phishing vector and to confirm whether additional sub‑domains share the same infrastructure.