shoppinggod[.]shop

Analysis of shoppinggod.shop indicates that the domain is currently offline but exhibits multiple indicators of a brand‑impersonation campaign targeting Apple. The domain was registered on 21 October 2025 through Gname.com Pte. Ltd., and its creation date aligns with typical short‑lived malicious infrastructure. Infrastructure analysis shows the domain resolves to 156.238.246.51, an address hosted in Hong Kong and announced by ASN 137899 (I LAYER LIMITED). The name server set consists of a.share‑dns.com, a9.share‑dns.com, b.share‑dns.net and b9.share‑dns.net, a pattern frequently observed in automated registration services. No TLS certificate is presented, meaning any HTTP connection would be unencrypted.

Reputation services provide strong evidence of malicious intent. VirusTotal reports that 16 of 95 scanned security vendors flag the domain, and the domain appears on a single known security blocklist. AlienVault OTX has incorporated the domain into 15 distinct threat‑intelligence pulses, reinforcing its association with malicious activity. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy explicitly blocks the host, confirming that trusted filtering solutions treat the domain as hostile. The page title returned from the HTTP response is “TikTok”, which does not correspond to the declared brand target of Apple, suggesting an attempt to mislead users or to reuse compromised content.

The primary uncertainty lies in the exact payload delivered when the site was accessible, as the offline status prevents verification of the landing page contents. Additionally, the discrepancy between the page title “TikTok” and the Apple impersonation claim cannot be resolved without a live snapshot. Defenders should therefore treat any traffic to shoppinggod.shop as malicious.