bluewhalellc[.]shop

PhishDestroy identifies bluewhalellc.shop as an active fake invoice phishing domain currently under investigation. This site masquerades as a legitimate vendor to trick users into downloading malicious attachments or entering payment details on spoofed checkout pages.

This domain was flagged with zero detections on VirusTotal (2/95), resolving to IP 107.174.47.231 and registered through NAMECHEAP INC on August 26, 2025. It holds a Let’s Encrypt SSL certificate, suggesting an attempt to appear trustworthy despite its recent creation and lack of historical reputation data. No blocklist entries or trust score improvements have been recorded to date.

Organizations should block bluewhalellc.shop at the firewall and DNS level, warn users about unsolicited invoice emails, and scan endpoints for signs of credential harvesting or malware download attempts. Given the absence of AV coverage and the domain’s fresh registration, this threat remains unmitigated until further IOCs are collected and shared.