cupsey[.]shop

This domain, cupsey.shop, is actively flagged as part of a delivery scam operation targeting retail consumers. Registered on March 13, 2026, through Global Domain Group LLC, the domain currently resolves to IP address 35.157.26.135 and displays a page title of 'HappyPillCo.' Analysis of the infrastructure reveals the use of Shopify and Netlify technologies, alongside HTTP Strict Transport Security (HSTS) implementation, which may be leveraged to lend an appearance of legitimacy to the fraudulent storefront. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility and automation. Security vendors have detected malicious activity associated with this domain, with 16 out of 95 engines on VirusTotal flagging it as harmful. Additionally, the domain appears on two security blocklists and has been included in 23 threat intelligence pulses on AlienVault OTX, indicating widespread recognition of its malicious nature. The domain is currently blocked by at least two security systems, further corroborating its classification as a high-risk threat. Despite these indicators, the domain remains active as of July 12, 2026, suggesting ongoing abuse. The exact nature of the scam remains partially unclear due to limited visibility into the operational details of the site. However, the combination of a newly registered domain, a retail-themed page title, and the use of e-commerce technologies strongly suggests an attempt to deceive users into providing payment or personal information under false pretenses. Defenders should prioritize blocking this domain at the DNS and network levels, as well as monitoring for any associated phishing emails or advertisements that may direct users to this infrastructure. Given the domain's presence on multiple threat intelligence feeds, organizations should also review logs for any prior connections to 35.157.26.135 or related indicators to identify potential compromise.