What happened
PhishDestroy posted on Mastodon on 12 November 2026 three.shop domains it flagged: yervion[.]shop, xorlena[.]shop and xireka[.]shop. Its records show all three were registered on 1 July 2026 and use the same storefront template titled "Best Deals & Prices Online", with a promotional banner and five-star "verified buyer" testimonials; they were flagged by 18 to 20 of 92 VirusTotal engines. Before buying from an unfamiliar shop, check how old the domain is, look for a real company address and use a payment method with buyer protection. The domains are also on the Phishing Army blocklist.
How the scam works
Fake and copycat shops are often new domains with catalogues, photos and branding taken from real stores, pushed through sponsored ads and large discounts. What arrives, if anything, is usually a cheap copy, or nothing. Some of these shops share a platform or a hosting pattern. A brand whose name or photos appear is not necessarily the seller and is not involved. Do not pay a newly registered shop you reached only from an ad, especially when the discount is huge and the contact details are thin. If you already paid, contact your bank or card issuer promptly and keep the ad, the checkout page and any chat records.
If a message, a page or a caller creates urgency about money, a login or a legal threat, pause and check the claim through a contact method you already trust. Keep screenshots, reference numbers and the exact addresses or phone numbers you were given, and tell your bank early if money has already left the account. Official brands and authorised firms named in a lure are not involved unless a primary source says otherwise.
Source
Source: https://mastodon.social/@phishdestroy/117603157102322602 (PhishDestroy (@phishdestroy@mastodon.social), Nov 12, 2026, 6:09 AM ET)
