https://ultimatesewingchair.com/
66.29.132.135 · Namecheap, Inc.
Los Angeles, United States
902 days
200 · 27.7s
Valid· Sectigo Public Server Authentication CA DV R36, Sectigo Limited, GB
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Ultimate Sewing Chair
Vendors
30/31
Status
partial
No KB/IOK detections were recorded for this scan.
finance | technology | ecommerce | government | other · 6/3/2026
The page presents branding for Ultimate Sewing Chair with IRS impersonation signals in the domain intelligence. The page title references IRS, which is inconsistent with the domain ultimatesewingchair.com and suggests impersonation. Technical signals show SPA-like behavior with numerous external scripts and analytics calls, but there is no direct credential harvesting form detected in static HTML. Visual cues in the screenshot indicate a branded chair site, not an official IRS site; however, the domain appears legitimate for Ultimate Sewing Chair, while the page title impersonates a government agency. Overall, evidence supports impersonation signals rather than a clear credential phishing flow on the observed surface, but the site’s SPA nature and external assets warrant caution. Analyst flagged likely cloaking/evasion behavior for this target. Analyst context noted: Website is manipulating Google and cloaking with Turkish IP to show betting information with pshishing details Analyst note: this target may cloak content or block scanners.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 121
Hosts: 6
Domains: 6
The domain presents clear impersonation signals via the page title referencing IRS on a non-official domain, which is a phishing-like tactic aimed at impersonation. While the current HTML lacks a static login form, the SPA nature with many external scripts and potential credential capture logic in JS warrants suspicion. Given the impersonation cue and the site's behavior of loading analytics and third-party scripts, the page should be monitored for credential harvesting or malware delivery via dynamic forms. Therefore, escalate for abuse review and continued monitoring; block or suspend only if corroborated by credential theft indicators or detectable abuse payloads. Analyst-reported cloaking/evasion suspicion increases confidence that the operator is actively attempting to evade automated security analysis. Analyst context was provided and corroborated during this assessment (Website is manipulating Google and cloaking with Turkish IP to show betting information with pshishing details Analyst note: this target may cloak content or block scanners.).
Monitor