ljwew[.]shop

Analysis of www.ljwew.shop indicates that the site was registered on March 22, 2026 through GNAME.COM PTE. LTD. and is currently taken offline. The domain resolves to IP address 47.88.27.229, which is hosted by Alibaba.com LLC in the United States. DNS resolution uses the nameservers a2.share-dns.com and b2.share-dns.net.

The web server presents a Let's Encrypt R12 certificate and advertises HTTP Strict Transport Security (HSTS). Service detection shows Nginx as the web server and jQuery as a client‑side library. The page title returned during the last scan was "LJ | Iniciar sesión," consistent with the listed scam type of an e‑commerce credential harvest. VirusTotal scanned the domain and recorded 2 detections out of 94 security vendors, indicating that at least a small subset of scanners flagged the site as malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single public blocklist, specifically PhishDestroy.

The overall risk level is marked elevated, and the threat type is classified as generic phishing. While the site is offline, the combination of a low trust score, partial VirusTotal detections, and inclusion on a phishing‑specific blocklist suggests an active malicious infrastructure that may be re‑hosted or re‑activated. Defenders should continue to block the domain and its resolved IP, monitor the registrar and nameservers for any changes, and add the domain to internal blacklists. Ongoing telemetry on re‑appearance or related domains should be collected to inform broader phishing mitigation efforts.