shedowpay[.]com

This domain, shedowpay.com, was registered on April 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active with a high-risk phishing classification. Infrastructure analysis reveals the domain resolves to 91.196.35.130, located in Moscow, Russia, and uses nameservers ns1.gcorelabs.net and ns2.gcdn.services. The site returns an HTTP 200 status and displays the page title 'Caddy works!', indicating a functional but minimal web server setup likely intended for malicious use. SSL certification is provided by Let's Encrypt, a common practice among both legitimate and malicious domains. The domain appears on one security blocklist and has been flagged in 22 threat intelligence pulses on AlienVault OTX, suggesting prior detection by multiple security entities. Four of 94 security vendors on VirusTotal have marked this domain as malicious, though the specific nature of the phishing campaign remains unconfirmed. No brand impersonation or scam type is evident from the available data, and the exact content of the site has not been analyzed. Defenders should treat this domain as high-risk, block resolution at the DNS level, and monitor for connections to the associated IP and nameserver infrastructure. Further investigation is recommended to determine the target or payload.