shop[.]xu9990[.]com

Analysis of the domain shop.xu9990.com indicates it is a confirmed phishing threat, currently offline as of July 23, 2026. The domain was created on February 21, 2026, and resolved to the IP address 154.220.96.211, hosted under AS135097 LUOGELANG (FRANCE) LIMITED in Hong Kong. Security vendors on VirusTotal flagged this domain, with 16 of 93 engines detecting malicious activity, reinforcing its classification as a phishing site. It appears on at least one security blocklist and is blocked by PhishDestroy, while Gridinsoft assigns it a trust score of 0/100, further confirming its high-risk status.

The SSL certificate issued for this domain is identified as R13, a common indicator in phishing infrastructure due to its low validation standards. No specific brand or page content details are available from the provided data, so the exact nature of the phishing scheme remains unconfirmed. However, the domain name suggests an attempt to mimic a retail or e-commerce platform, a frequent tactic in credential theft or payment fraud campaigns.

Defenders should treat this domain as malicious and enforce blocking at the DNS or proxy level. Security teams are advised to monitor logs for connections to the associated IP (154.220.96.211) and review any historical interactions with shop.xu9990.com in their environments. Given its current offline status, further forensic analysis may be limited, but the infrastructure details remain actionable for threat hunting and detection rule updates.