mass.report
Scan Intelligence Report0/100
medium Risk
siksilkstudio.shop
https://siksilkstudio.shop/
IP
172.67.174.10 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
—
HTTP
200 · 41.4s
SSL
Valid· E8, Let's Encrypt, US
Status
COMPLETED
Domain Intelligence: siksilkstudio.shop
Scanned 2 times since May 3, 2026, 04:06 PM UTC
✗ Critical (93)
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
SikSilk (siksilkstudio.shop)
UnknownE-Commerce · 6/3/2026
Summary
The page presents SikSilk branding and product catalog, with domain siksilkstudio.shop. Visual assets (logo, product imagery) and page title strongly indicate SikSilk branding. There is no clear credential harvesting form or login phishing prompt observed in the static HTML; however, the site appears to clone SikSilk’s storefront aesthetics. The evidence does not conclusively show credential harvesting or impersonation beyond potential branding similarity; further behavioral cues (URL path impersonation of a brand’s official subdomain or deceptive UI prompts) are needed to confirm phishing.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸POST targets observed during capture: https://siksilkstudio.shop/cdn-cgi/rum?.
▸Distinctive asset clues: 6874-98a7f8268e192452.js, webpack-e74951a75cd93e7f.js, d482fd41f7f1f379.css, css2, logo_url_1774082910.svg, SS26-TEMP-BANNER-DESKTOP-EN_d25ce771-6a80-4305-ab02-0a1b424e9739.jpg.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 70
Hosts: 5
Domains: 4
Suspicious Endpoints
hxxps://siksilkstudio[.]shop/
Observed Signals (1)
Cloudflare and Let's Encrypt certificate observed; no direct credential collection form detected in static HTML
Observed Indicators (1)
▸Form in static HTML present but no visible login/password fields; credentialUi not detected in static HTML
Risk AssessmentUsed in abuse reports
The scan shows SikSilk branding on a domain siksilkstudio.shop with multiple asset loads typical of a storefront. There is no explicit login form or credential capture observed in the static HTML, but the presence of hidden form inputs and a high number of external scripts could indicate a dynamic page with client-side authentication or analytics. The domain is new (cert valid in 2026) and behind Cloudflare, which can be common for legitimate sites but also used for phishing clones. The evidence does not definitively prove phishing; continued monitoring of URL paths, form behavior, and data exfiltration endpoints is recommended.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API