scentvoyage[.]shop

This domain, scentvoyage.shop, was registered with GoDaddy.com, LLC on 26 October 2025 and resolves to the Cloudflare address 23.227.38.32, AS13335, located in Canada. The authoritative name servers are ns23.domaincontrol.com and ns24.domaincontrol.com. No TLS certificate is presented, indicating the site operated without HTTPS. Infrastructure analysis shows a Gridinsoft trust score of 13 out of 100, classifying the host as low‑reputation. The domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy sinkhole.

VirusTotal scans recorded 14 of 95 security‑vendor detections, and AlienVault OTX references the domain in 14 threat‑intel pulses, confirming its association with malicious activity. The campaign is identified as a brand‑impersonation effort targeting PayPal, consistent with the “Brand Impersonation” scam type in the intelligence. Current operational status is offline, which limits real‑time verification of payloads or page content. Because the site lacks an SSL certificate and its trust score is minimal, defenders should treat any historical or residual traffic as potentially hostile.

Recommended defensive actions include adding the domain and its resolving IP to network‑level deny lists, ensuring DNS filtering solutions block queries for scentvoyage.shop, and confirming that endpoint protection products are updated to recognize the 14 vendor detections reported by VirusTotal. Continuous monitoring of Cloudflare‑origin IP ranges for similar low‑trust domains is advised, as the attacker may redeploy the campaign using adjacent address space. Organizations that rely on PayPal should educate users about unsolicited PayPal‑related communications and enforce multi‑factor authentication to mitigate credential‑theft risk.