store[.]holdgeneral[.]ca

This domain, store.holdgeneral.ca, is currently active and engaged in generic phishing activity targeting retail checkout processes. Analysis indicates the infrastructure is designed to harvest payment credentials, shipping details, and personal information from victims under the guise of a legitimate e-commerce transaction. The domain remains operational as of the latest verification, posing a high-risk threat to consumers and organizations alike. Infrastructure analysis reveals the domain was registered through Go Get Canada Domain Registrar Ltd. on May 19, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or appear legitimate. It resolves to the IP address 188.114.96.3, which is associated with Cloudflare, Inc. in Canada. The domain is secured with a Let's Encrypt SSL certificate (serial number E7), a common tactic used to lend false credibility to phishing sites. Security vendor assessments on VirusTotal show that 4 out of 95 engines have flagged this domain as malicious. Additionally, the domain appears on one security blocklist, though broader coverage remains limited. Current status confirms the domain is still active, with no signs of takedown or disruption. The use of Cloudflare hosting and a valid SSL certificate complicates detection and mitigation efforts, as these elements are often trusted by default in security and browser assessments. Organizations and individuals are advised to block the domain at the network level and include the IP address 188.114.96.3 in firewall or DNS filtering rules. End users should be educated to verify domain authenticity before entering sensitive information, particularly during checkout processes. Security teams are recommended to monitor for related domains registered through the same registrar or resolving to the same IP range, as this may indicate a broader campaign.