pointscheck[.]shop

Analysis of pointscheck.shop indicates that the domain is actively being used in a generic phishing campaign. Registration records show the domain was created through Dynadot Inc., and the authoritative name servers are cloe.ns.cloudflare.com and kirk.ns.cloudflare.com, both hosted by Cloudflare. An HTTP request to the site returns a 403 Forbidden status, suggesting that the web server is currently configured to deny access or that the malicious payload is being served only to specific clients. VirusTotal scans have recorded a single positive detection out of 91 security vendors, demonstrating that at least one anti‑malware engine has identified malicious behavior associated with the domain.

The domain is listed on one public blocklist and is actively blocked by the PhishDestroy service, confirming that threat‑intelligence feeds consider it malicious. The risk rating assigned is high and the operational status remains active as of the report date. Uncertainty remains regarding the underlying hosting IP address, TLS certificate details, and the specific content displayed to victims, as no page title or content hash has been released.

Defenders should treat pointscheck.shop as a confirmed phishing threat and ensure that network perimeter controls, DNS filtering, and endpoint security solutions block resolutions to this domain. Continuous monitoring of its DNS records and any changes to its detection count on VirusTotal or additional blocklist inclusions is recommended. Incident response teams should also consider adding the domain to internal blocklists and flagging any outbound connections to its IPs as suspicious.