Criticalscore 60 · flagged Saturday, September 19, 2026

sirclothing.shop

Appeared in the .shop zone on Saturday, September 19, 2026; by the end of that day the census found active website about beauty fashion. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: Paypal
+22
brand in page title, not in the name
matched: paypal
+20
form on a brand-styled page
matched: has_form
+18
Registrar
Nameserver provider
Nameservers
ndns1.cosmotown.com, ndns2.cosmotown.com
First-day state
active website
HTTP status
200
Page title
Ready-to-wear, Separates and Intimates | SIR.
Has a form
yes
Brand echoed

Model opinions

Second opinionlooks like a scamtarget: SIR. (SIR the Label)confidence 78%· claude-opus-5

Newly registered .shop domain hosts a full storefront copying the Australian label SIR. — its wordmark, product names (Mathias Oversized Blazer, Elsie Lace Gown) and lifted campaign imagery — under a name the brand does not own, with generic fabricated testimonials and 'free global shipping / flexible payments' lures; the PayPal reference is a checkout badge, so this reads as a counterfeit/fake-shop payment-harvesting clone rather than a credential phish.

First passlooks benignconfidence 85%· claude-haiku-4-5

SIR. is a legitimate Australian designer clothing brand with its own branding, product line, and business model. The PayPal reference in the scorer evidence appears to be a payment method option (common for e-commerce sites), not impersonation of PayPal itself. The form is a standard account/checkout form for the brand's own clothing business, not a credential-harvesting phish pretending to be PayPal or another organisation.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Saturday, September 19, 2026

Screenshot of sirclothing.shop taken by the zone census on 2026-09-19

Same data as JSON: /api/zone/domain/sirclothing.shop. This page is not indexed by search engines and does not link to the site it describes.