loveshop3[.]com

Analysis of loveshop3.com, a domain created on November 10, 2023 and registered through NiceNIC International Group Co., Limited, indicates that it was used for a generic phishing operation before being taken offline. The site resolved to IP address 91.206.71.138, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the Netherlands. DNS resolution used Cloudflare nameservers cody.ns.cloudflare.com and jamie.ns.cloudflare.com. The page title observed during investigation was the Russian phrase "Вы не робот?", suggesting a possible language targeting or bot verification element, but no further page content has been captured.

The domain was blocked by PhishDestroy and appears on one security blocklist, confirming that it was recognized as malicious by at least one external sinkhole. SSL termination was provided by Google Trust Services under the WE1 certificate, a common configuration for Cloudflare‑proxied sites. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of malicious intent.

VirusTotal analysis recorded four detections out of ninety‑five scanning engines, providing additional corroboration of the site’s malicious nature. Current status is offline, which limits active threat exposure, but the infrastructure artifacts—IP address, nameservers, SSL certificate, and blocklist entries—remain valuable for defensive correlation. Security teams should continue to block the domain and associated IP, monitor for any re‑registration attempts, and incorporate the observed indicators into threat‑intel feeds to pre‑empt potential reuse in future phishing campaigns.