On 25 July 2026, the domain www.zm11.shop was observed hosting a site titled “Wish Shopping Lite”. The domain was registered on 5 August 2025 through Gname.com Pte. Ltd. and is configured to use the Cloudflare nameservers haley.ns.cloudflare.com and sage.ns.cloudflare.com. DNS resolution points to 104.21.34.190, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site employed a Google Trust Services / WE1 SSL certificate, indicating a valid TLS handshake, and the web stack was identified as Node.js running Express, with front‑end assets built on Tailwind CSS and real‑time communication via Socket.io. Cloudflare Browser Insights and HTTP/3 were also detected, confirming that the site leveraged Cloudflare’s performance and security services.
Security‑vendor telemetry shows that the domain is listed on a single blocklist and was actively blocked by PhishDestroy. VirusTotal recorded a single positive detection out of 95 scanned scanners, and Gridinsoft assigned a trust score of 1 / 100, reflecting an extremely low reputation. The risk level was classified as elevated, and the current operational status is offline. The available evidence points to a classic credential‑harvesting campaign that mimics the Wish shopping experience, as suggested by the page title.
However, the limited detection footprint—only one blocklist entry and a solitary VT positive—leaves open the possibility that the campaign was short‑lived or that additional indicators have not yet been shared with public repositories. No further details about the content of the landing page, login forms, or payloads have been disclosed. Defenders should add the domain and its associated IP address to local deny lists, monitor for any new sub‑domains under the same registrar or Cloudflare account, and enforce strict URL filtering for “Wish Shopping Lite” keywords.
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Certificate fingerprint3a6fcb562edd6ad9eaa1ab5c73bf7c7e4022d816e45a8ec221b41aeff22f4978Certificate names · 1 SANs
zm11.shop
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
Gridinsoft Analysis
1 / 100
(SG)
