0/100

critical Risk

siksilkstudio.shop

https://siksilkstudio.shop/account

172.67.174.10 · Cloudflare, Inc.

Location

Toronto, Canada

Domain Age

—

HTTP

200 · 16.5s

SSL

Valid· E8, Let's Encrypt, US

Status

COMPLETED

Visual Evidence

Zoom

Title: "Sign in"

Save

Domain Intelligence: siksilkstudio.shop

Scanned 2 times since May 3, 2026, 04:06 PM UTC

✗ Critical (93)

Linked Phishing Report

This scan is attached to a vendor submission report

Brand

SIKSILK (siksilkstudio.shop)

Vendors

29/31

Status

partial

✓ urlquery✓ chainpatrol✓ polyswarm✓ fortiguard✓ sophos✓ microsoft✓ yandex✓ avg✗ norton✓ brightcloud✓ avast✓ bitdefender✗ threatyeti✓ kaspersky✓ apple✓ spamhaus✓ cisa✓ netcraft✓ urlscan✓ apwg✓ emsisoft✓ openphish✓ isitphish✓ phishtank✓ phishreport✓ eset✓ virustotal✓ mcafee✓ drweb✓ urlabuse✓ google

KB/IOK Matches (0)—

No KB/IOK detections were recorded for this scan.

SikSilk Studio (siksilkstudio.shop)

Credential Phishing

E-Commerce · 6/3/2026

Summary

The page presents a sign-in UI with a logo and branding that strongly resemble SikSilk branding, but the domain is siksilkstudio.shop, which is not the official SikSilk domain. Network and page resources show authentic-looking brand assets (logo URL, fonts, open graph metadata) and a login form with a password field. The mismatch between the visible brand (SikSilk) and the hosting domain (siksilkstudio.shop) constitutes impersonation signals, suggesting credential harvesting potential via first-impression cloning; however, the page appears to be part of a SPA serving a login surface rather than confirmed abuse of an official SikSilk service. Post endpoints include analytics tracking which can be benign or used for credential capture; the presence of a login form is considered a strong indicator for potential phishing when paired with a non-official domain.

Evidence Summary

▸Observed 2 capture stage(s); canonical stage is settled_render.

▸Canonical stage contains password collection UI.

▸POST targets observed during capture: https://siksilkstudio.shop/cdn-cgi/rum?, https://siksilkstudio.shop/api/analytics/track.

▸Distinctive asset clues: v8c78df7c7c0f484497ecbca7046644da1771523124516, webpack-e74951a75cd93e7f.js, css2, d482fd41f7f1f379.css, logo_url_1774082910.svg.

Capture

Stages: 2

Canonical: Settled Render

Changed: No

Credential Signals

Forms: 2

Password fields: 1

Late-stage login UI: No

Resource Signals

Resources: 69

Hosts: 5

Domains: 4

Suspicious Endpoints

hxxps://siksilkstudio[.]shop/api/analytics/track

hxxps://siksilkstudio[.]shop/account

Attack Techniques (5)

Brand impersonation via visual clone (SikSilk branding on non-official domain)Credential collection UI (password field and login form)SPA-based form rendering (heavy external script loading for UI rendering)Credential exfiltration signals via POST to analytics/track endpoint and rum endpointTLS certificate from Let's Encrypt on a new domain

Indicators of Compromise (7)

▸Domain does not match official SikSilk site (official domains not evident in evidence)

▸Page title Sign in and visible SikSilk-like branding on siksilkstudio.shop

▸Two POST forms targeting /account and analytics endpoints (potential data collection)

▸External script bundles loaded from the same domain and asset names hinting at a React/Next.js SPA

▸Logo image loaded from img.siksilkstudio.shop and open graph metadata referencing SikSilk branding

▸SSL certificate issued by Let's Encrypt for a new domain (MAR 2026 – JUN 2026)

▸Cloudflare IP and WAF presence (common for many sites; not definitive alone)

Risk AssessmentUsed in abuse reports

The scanner identified a legitimate login surface on a non-official domain claiming SikSilk branding, with a password field and login form, and analytics endpoints that could be used to capture user data. The brand appears impersonated on siksilkstudio.shop, which constitutes a high risk for credential collection. Given the impersonation signals and the presence of a login form on a non-official domain, this activity should be treated as credential phishing risk and monitored closely. If further evidence confirms this domain is not affiliated with SikSilk, takedown actions are warranted; if it is a first-party but abusive page, classify accordingly with urgency.

Recommended Action

Block URL

Cross-Reference9

URL Intelligence