ifshop[.]org

The domain ifshop.org was registered on 7 June 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the Cloudflare‑owned address 188.114.97.3, which is announced by AS13335 and geolocated in the United States. The authoritative nameservers are linda.ns.cloudflare.com and memphis.ns.cloudflare.com, indicating that the domain relies on Cloudflare’s DNS and edge services. TLS termination is provided by a Google Trust Services certificate issued under the WE1 program, confirming the use of a legitimate certificate authority. A single page was observed with the title “Collector Crypt Gacha Machine”.

No additional content has been captured, and the site is currently marked as taken offline. The limited visibility prevents verification of the exact phishing mechanics, such as credential‑stealing forms or malicious redirects, leaving the functional payload uncertain. Detection data show that four of ninety‑one VirusTotal scanners flagged the domain as malicious, and Gridinsoft assigned a trust score of zero out of one hundred, suggesting a high confidence of abuse. Independent blocklist feeds have already listed the domain; it appears on four public blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. These multiple independent detections reinforce the assessment of the domain as a phishing resource.

Given the infrastructure profile—newly created domain, Cloudflare hosting, legitimate SSL, and rapid inclusion on threat‑intelligence feeds—defenders should treat the domain as hostile. Recommended actions include adding the domain and its hosting IP to firewall and DNS filtering policies, monitoring the IP range for re‑use, and continuing to query threat‑intel platforms for any re‑appearance. Because the site is offline, evidence collection should focus on archival crawls and DNS history to aid attribution.