Criticalscore 68 · flagged Wednesday, November 4, 2026

azurshop.top

Appeared in the .top zone on Wednesday, November 4, 2026; by the end of that day the census found active website about e-commerce & retail. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

TLD with a high abuse rate
matched: top
+8
page impersonates a brand
matched: PayPal
+22
brand in page title, not in the name
matched: paypal
+20
form on a brand-styled page
matched: has_form
+18
Registrar
—
Nameserver provider
Nameservers
ns5.myhostadmin.net, ns6.myhostadmin.net
First-day state
active website
HTTP status
200
Page title
AZUR — Down jackets, coats & sneakers | Free shipping worldwide
Has a form
yes
Brand echoed
—

Model opinions

Second opinionlooks like a scamconfidence 60%· claude-opus-5-5

The PayPal hit is only a payment-method mention on a self-branded 'AZUR' clothing store, so this is not PayPal impersonation. It does show the fake-shop pattern: a day-old .top domain on myhostadmin.net DNS, generic templated copy, low prices on 700–800 fill down coats, a push toward bank transfer, and a WhatsApp operator contact with no verifiable business identity.

First passlooks like phishingtarget: PayPalconfidence 92%· claude-haiku-4-5

The page impersonates PayPal by prominently displaying the PayPal brand name and logo in the context of a fake checkout, with messaging about 'PayPal or bank transfer' payment options designed to harvest payment credentials. The domain 'azurshop.top' hosts a form (post→self) with no legitimate offsite links, matching the 'sealed-room' phishing pattern; the operator contact via WhatsApp (wa.me) and the scorer's detection of brand-impersonation + form-on-brand-page confirm this is a credential/pay

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Wednesday, November 4, 2026

Screenshot of azurshop.top taken by the zone census on 2026-11-04

Same data as JSON: /api/zone/domain/azurshop.top. This page is not indexed by search engines and does not link to the site it describes.