newsletter[.]retentionx[.]com

newsletter.retentionx.com is currently classified as a high‑risk brand‑impersonation campaign targeting Shopify users. The site presents the page title "RetentionX Newsletter" and is associated with the scam type "Social Media Phishing". Intelligence sources indicate that the domain has been added to the PhishDestroy and ScamSniffer blocklists, and two security vendors on VirusTotal have raised detections, yielding a 2/95 flag ratio. Infrastructure analysis shows the domain was registered on 15 October 2006 through GoDaddy.com, LLC and continues to use the default GoDaddy nameservers ns01.domaincontrol.com and ns02.domaincontrol.com. DNS resolution points to IP address 104.18.68.40, which belongs to AS13335 operated by Cloudflare, Inc., placing the host in the United States. The TLS certificate is issued by Google Trust Services under the WE1 authority, confirming a valid HTTPS endpoint that returns HTTP 200. The observed indicators include a Gridinsoft trust score of 0 / 100, presence on two external blocklists, and the deployment of multiple analytics and advertising tags commonly linked to major social platforms and tag‑management services. These tags suggest the operator is leveraging tracking infrastructure to monitor victim interaction. The combination of a legitimate SSL certificate, active web‑server, and low trust score reinforces the likelihood of a malicious payload delivered via the advertised newsletter. While the current data set confirms the domain’s malicious intent, the exact content of the landing page has not been captured, leaving the specific phishing vector undefined. Defenders should block the domain at DNS and web‑filter layers, monitor outbound connections to the identified IP, and incorporate the domain’s hash into endpoint detection rules. Continuous re‑evaluation is advised, as the threat actor may modify the site or shift hosting infrastructure.