premium-reward2026[.]shop

This domain, premium-reward2026.shop, is identified as an active phishing campaign targeting users of the Japanese payment service PayPay. The threat type is classified as generic phishing with a high-risk assessment due to its deceptive reward offer, specifically a fabricated promotion promising 80,000 PayPay points for annual spending of 300,000 yen. The page title, 『期間限定』年間30万円利用で80,000 PayPayポイントプレゼント！, explicitly impersonates PayPay’s branding to manipulate victims into disclosing sensitive financial credentials or personal information. Infrastructure analysis reveals that premium-reward2026.shop was registered on June 15, 2026, through Nicenic International Group Co., Limited, a registrar frequently associated with malicious domains. The domain resolves to the IP address 172.67.218.78, hosted on Cloudflare’s network (AS13335), which is commonly exploited to obfuscate the true origin of phishing infrastructure. Detection metrics indicate limited but targeted flagging: the domain is recognized by 3 of 95 security vendors on VirusTotal and appears on three distinct security blocklists. The SSL certificate, issued by Google Trust Services (WE1), further corroborates the use of legitimate-appearing encryption to enhance the campaign’s credibility. Current status confirms the domain remains operational, posing an ongoing risk to unsuspecting users. Organizations and individuals are advised to implement immediate countermeasures, including blocking the domain and its resolving IP (172.67.218.78) at the network perimeter. End-users should be alerted to the fraudulent nature of the promotion, particularly the unrealistic reward-to-spend ratio, and instructed to verify all financial offers directly through PayPay’s official channels. Continuous monitoring of related domains registered under Nicenic International Group Co., Limited is recommended to preemptively identify emerging threats.