myshop-711-com-tw[.]099xs[.]link

This domain, myshop-711-com-tw.099xs.link, is identified as a brand impersonation phishing site targeting users of 7-Eleven Taiwan. The site presents a fraudulent login portal designed to harvest credentials, payment details, or other sensitive information from victims who believe they are interacting with a legitimate retail service. The page title, rendered in garbled text as "恭喜，站点创建成功！," suggests a generic success message, likely intended to deceive users into proceeding with account verification or checkout processes. Analysis indicates the site may also attempt to distribute malware or redirect users to additional fraudulent pages under the guise of completing transactions. Infrastructure analysis reveals the domain was registered on September 5, 2025, through Unstoppable Domains Inc., a registrar frequently associated with high-risk or newly observed phishing campaigns. The domain resolves to the IP address 205.186.112.105, which has been linked to multiple other phishing sites in recent months. As of the latest scan, 6 out of 95 security vendors on VirusTotal have flagged this domain as malicious, with detections including phishing, credential theft, and brand abuse. The combination of a newly registered domain, a registrar with a history of hosting fraudulent sites, and a low but notable detection rate underscores the active and evolving nature of this threat. Users who have visited myshop-711-com-tw.099xs.link should take immediate action to mitigate potential risks. First, do not enter any credentials, payment information, or personal details on the site. If any information was already submitted, assume it has been compromised and proceed with the following steps: reset passwords for any accounts accessed on or after the visit, enable multi-factor authentication where available, and monitor financial statements for unauthorized transactions. Scan the device used to access the site with updated security software to detect and remove any malware. Additionally, report the domain to local cybersecurity authorities or the legitimate brand being impersonated to aid in takedown efforts. Organizations should block this domain and its associated IP address (205.186.112.105) at the network level to prevent further exposure.