shopifybuy004[.]top

Analysis of shopifybuy004.top shows a newly registered domain created on February 21, 2026 that is currently offline but was previously used for a Binance brand impersonation campaign. The site presented a page title of "shopify" and was classified as a crypto scam. Hosting resolves to IP address 172.67.136.204, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate listed as WE1 indicates the site employed HTTPS, a common tactic to lend credibility to fraudulent pages.

Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 out of 100 and Gridinsoft reports a score of 0 out of 100, reflecting consensus that the site is malicious. VirusTotal scans flagged the domain in 16 of 93 security engines, providing independent confirmation of its malicious nature. The domain appears on one security blocklist and is actively blocked by PhishDestroy, reinforcing its status as a recognized threat. AlienVault OTX references the domain in a single threat‑intel pulse, further corroborating its involvement in illicit activity.

The elevated risk rating aligns with the combination of low trust scores, multiple vendor detections, and explicit brand impersonation of Binance. Defenders should ensure that any outbound connections to 172.67.136.204 are denied, add shopifybuy004.top to URL filtering and DNS blocklists, and monitor for residual artifacts such as residual cookies or credential leaks that may have been harvested before takedown. Continuous re‑evaluation is advised, as the offline status may change if the operators reactivate the infrastructure.