588gjas2vax[.]shop

Analysis of 588gjas2vax.shop, observed on July 19, 2026, confirms active involvement in a generic phishing operation. The domain resolves to IP 83.229.124.67, which is geolocated to Hong Kong (S G IX) and is served by a Let's Encrypt certificate identified as YE1. HTTP requests return a 301 redirect and the final page title is "401 Authorization Required," indicating that the site does not present a conventional landing page. Registration details show the domain was created through GNAME.COM PTE. LTD., and DNS is managed by a6.share-dns.com and b6.share-dns.net. Threat intelligence sources flag the domain: PhishDestroy lists it as blocked, VirusTotal records 16 of 91 scanners marking it malicious, and AlienVault OTX cites the domain in seven separate pulses. It also appears on one external blocklist. While the exact phishing payload or credential‑stealing mechanism has not been publicly disclosed, the convergence of certificate, redirection behavior, and multiple vendor detections suggests a high‑risk profile. Defensive teams should add 588gjas2vax.shop and its resolving IP 83.229.124.67 to outbound deny lists, monitor DNS queries for the associated nameservers, and ensure that any inbound traffic to the domain is blocked at perimeter devices. Continuous re‑evaluation is advised as additional indicators may emerge.