kyc-shop[.]net

The domain kyc-shop.net was registered on February 21 2026 through Tucows Domains Inc. It resolves to the IPv4 address 75.2.60.5, which is allocated to Amazon.com, Inc. (AS16509) and geolocated in the United States. TLS termination is provided by a Google Trust Services certificate issued to the WE1 trust anchor, indicating a valid HTTPS endpoint. The domain is served behind Cloudflare, as evidenced by the authoritative nameservers amy.ns.cloudflare.com and phil.ns.cloudflare.com, and the presence of Cloudflare Browser Insights and HTTP/3 support.

Mail exchange records point to Zoho’s mail infrastructure, specifically mx.zoho.eu (priority 10) and mx2.zoho.eu (priority 20). The only publicly visible page returns HTTP status 200 and carries the title “Каталог аккаунтов”, which translates to “Account catalog”. No additional page content has been disclosed, leaving the exact phishing payload or credential‑capture mechanism unverified.

Threat‑intelligence sources assign a high risk rating to kyc-shop.net. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows one out of ninety‑five scanning engines flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The current status is listed as active, confirming that the infrastructure is still operational.

Defenders should add kyc-shop.net to DNS‑based deny lists and firewall rules to prevent outbound connections to the associated IP address. Continuous monitoring of the Cloudflare edge node for any changes in DNS resolution or certificate renewal is advised. Because the site’s internal layout has not been publicly parsed, deeper forensic collection of page content via sandboxed retrieval would help confirm the exact phishing technique and support attribution.