seller[.]shpeaa[.]cc

This domain is flagged as a high-risk phishing site specializing in credential theft under the guise of a legitimate Store App. Analysis indicates it operates as a generic phishing threat, designed to harvest user login details, payment information, or other sensitive data through fraudulent login portals or fake application interfaces. The page title 'Store App' suggests an attempt to mimic legitimate app stores or software distribution platforms, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain seller.shpeaa.cc resolves to the IP address 79.99.78.100 and was registered on June 25, 2026, through Dominet (HK) Limited. It is currently active and has been flagged by 13 out of 95 security vendors on VirusTotal, indicating a moderate but concerning level of detection. Google Safe Browsing has classified this domain under the 'SOCIAL_ENGINEERING' category, further confirming its deceptive nature. The domain employs a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the site. The creation date, set in the future, may indicate an attempt to evade initial scrutiny or suggest domain registration data manipulation. To mitigate risks associated with this phishing domain, organizations and individuals should immediately block access to seller.shpeaa.cc and its resolving IP address 79.99.78.100 at the network perimeter. Endpoint protection solutions should be updated to include this domain and its associated indicators in their blocklists. Users should be educated on recognizing phishing attempts, particularly those impersonating app stores or software download pages. If credentials or sensitive data were entered on this site, affected accounts should be secured immediately by changing passwords and enabling multi-factor authentication. Network logs should be reviewed for connections to 79.99.78.100 or interactions with the domain to identify potential compromises.