What Gridinsoft observed on uae.ap1.shop
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260826043915-9b3b04cf
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Phishing
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The exact host is a malicious financial phishing and task-scam application. It solicits credentials, deposits, payment vouchers, bank details, and withdrawal passwords through a VIP commission and matched-order workflow with frozen-account states. The customer screenshot shows active AED deposits in the same flow, and the live public backend links the site to a broader multi-country retail-impersonation network. The current Phishing classification should be retained.
Analyst findings
Review 4 documented observations View evidence
The exact host returned HTTP 200 and loaded a mobile single-page application whose current code implements invitation-only registration, login, VIP levels, matched shopping tasks or orders, commission balances, top-ups, payment-voucher uploads, bank-account collection, withdrawal passwords, frozen orders, and withdrawal workflows. These functions form the characteristic deposit-and-task loop of a task scam rather than a normal retail checkout.
-
HTTP status
200 -
Final URL
https://uae.ap1.shop/ - Page element Registration requests a phone number, login password, confirmation, and invitation code.
- Page element The application exposes VIP levels, commission rates, task or order matching, minimum balances, recharge, payment-voucher upload, bank details, and withdrawal passwords.
- Analyst observation The public code includes frozen-order and customer-service-to-unfreeze states.
The unauthenticated same-host API returned live configuration for the task platform. It enabled referral commissions, task limits, automatic freezing and unfreezing, VIP upgrades, deposits, withdrawals, bank-account collection, and plaintext withdrawal-password display. Its platform identity was internally inconsistent, and the country list linked related registration hosts using SHEIN, Alibaba, noon, and other retail-themed names across multiple countries.
-
HTTP status
200 - Public artifact URL https://uae.ap1.shop/api/mall/common/getSysParamConfig
- Public artifact URL https://uae.ap1.shop/api/mall/common/country/list
- Page element The configuration identified a Chinese platform name, Dominican Republic country value, ETB currency, and an unrelated mooncity.top website.
- Page element Related country entries linked registration sites on shein-vip.shop, alibaba-vip.shop, noon-vip.store, ap1.shop, and other domains.
The customer-supplied screenshot shows the application's Bill page with Top up and Withdraw tabs, a new AED 300 deposit marked Pending review, and earlier AED 65, AED 50, and AED 20 deposits marked Recharge successful. This exact supplied object is consistent with the deposit history implemented by the reviewed application.
- Screenshot SHA-256 47ee66696e81c9f3564c2f063ca841e313864902701c99e51260e5fedb2bd272
- Page element AED 300 — Pending review
- Page element Earlier AED 65, AED 50, and AED 20 deposits are shown as Recharge successful.
Public URL-scan records show six exact-host submissions from May through July 2026, mainly the same invitation-code registration URL and one bank-card-edit path. Parent-domain results also show related country subdomains with invitation registration pages. OTX collections mention task scams and retail-brand impersonation, while Wayback returned no successful exact-host HTML capture.
- Analyst observation Six exact-host URL-scan records included repeated registration submissions with invitation code JCNFDY7N and a bank-card-edit path.
- Analyst observation Parent-domain URL-scan records included bd.ap1.shop, om.ap1.shop, and gt.ap1.shop registration pages.
- Analyst observation No successful exact-host HTML snapshot was returned by Wayback.
Scope and limitations
- No account was created, no credentials or bank details were submitted, and no further payment or withdrawal was attempted by Gridinsoft.
- The review did not identify the real-world identity of the operator or determine whether any specific payment can be recovered.
- Public URL-scan, threat-intelligence, search, and archive indexes are incomplete; the verdict does not depend on their completeness.
- The verdict applies to uae.ap1.shop and the exact reviewed application and backend evidence; related hosts require their own current object-level review.
Help protect others by sharing this page on social media! The more people who know about uae.ap1.shop, the fewer chances they have to deceive someone else. Help others evaluate uae.ap1.shop by sharing this page on social media!