claudeshop[.]app

PhishDestroy identifies claudeshop.app as a live credential theft domain masquerading as a premium subscription service targeting unsuspecting users. The threat actor behind this site lures victims with the promise of exclusive access, only to harvest entered credentials and payment details for subsequent fraud or resale on dark web markets. This domain leverages social engineering by copying legitimate brand aesthetics and using a Let’s Encrypt SSL certificate to appear trustworthy. Visitors risk full account takeover and financial loss if any data is submitted via the fraudulent forms or checkout interfaces present on the page. This domain was flagged by PhishDestroy with high confidence based on confirmed intelligence: the site resolves to IP 138.201.82.173, was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 14, 2026, and currently shows a low detection rate with only 1 out of 95 VirusTotal security vendors flagging it at the time of analysis. Despite the low VT score, the domain remains active and is actively serving malicious content under the guise of a premium subscription portal. Its recent creation and minimal blocklist presence suggest a rapidly evolving threat campaign likely targeting tech-savvy users seeking AI or developer tools. If you visited claudeshop.app or entered any information, immediately change passwords on all related accounts, revoke any payment methods shared, and run a full antivirus scan. Report the domain to your email provider and financial institutions. Avoid reaccessing the site and warn others who may be considering similar subscriptions. Consider using password managers with built-in phishing detection and enabling multi-factor authentication on all critical accounts to prevent credential reuse attacks.