flax-loafers.shop is a suspicious domain on the PhishDestroy blocklist. Its name and .shop extension read like an online footwear store, but its page title only repeats the domain name and identifies no brand or product. PhishDestroy first detected it on 2026-10-08. At the last check on 2026-10-19, it could not be confirmed whether the site or its content was still live.
How the scam works
No specific scheme has been tied to this domain yet, so the risk rests on how vendors have labelled it. A phishing listing means the site is considered dangerous for anything typed into it, such as account logins, email passwords or payment card numbers. A shop-style name on a young domain fits a familiar pattern: visitors expect to buy something, so they hand over card and contact details more readily. The name suggests a footwear store, while the security listings classify the domain as phishing.
Evidence
17 of 92 VirusTotal engines flagged the domain on 2026-10-08, the same day PhishDestroy picked it up. The flagging vendors include alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, DNS8, ESET and Forcepoint ThreatSeeker. These are independent vendors, which makes a false alarm less likely. Spamhaus lists the domain in its DBL under the phishing category, and one AlienVault OTX threat pulse references it.
Infrastructure
The domain was registered through Spaceship, Inc. on 2026-07-31, about ten weeks before PhishDestroy detected it. That is a short lifespan typical of throwaway domains. It resolves to Cloudflare's network in the US, which places a proxy in front of the real server and hides where the content is actually hosted.
What to do
If you entered card details on flax-loafers.shop, contact your bank, ask for the card to be blocked and reissued, and dispute any charges you do not recognise. If you typed a password there, change it right away on every account that uses it, and turn on two-factor authentication. Treat follow-up emails or texts that mention an order from this shop as likely phishing. Defenders should block the domain at DNS and web proxies and check logs for users who visited it on or after 2026-10-08.
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
