Analysis of the domain shopee.farm indicates that it is currently active and has been identified as a generic phishing operation. The domain was registered on July 30, 2026 through GoDaddy.com, LLC and is served by Cloudflare nameservers apollo.ns.cloudflare.com and marjory.ns.cloudflare.com. DNS resolution points to the IP address 172.67.159.157, which is hosted on Cloudflare's network, a common choice for malicious actors seeking rapid deployment and mitigation of takedowns.
The domain appears on a single security blocklist and has been blocked by the PhishDestroy service, confirming that at least one defensive feed has flagged it as malicious. VirusTotal has recorded scans from 91 vendors, none of which reported a detection; however, the absence of detections does not constitute a safety assurance and may reflect limited payload analysis or evasion techniques. No public Safe Browsing, Open Threat Exchange, SSL certificate details, HTTP response codes, trust scores, page title, or evidence links are presently available, leaving those vectors unverified.
Defenders should continue to block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP, and consider adding the domain to internal blocklists. Ongoing observation is recommended to capture any future changes in detection status, additional blocklist listings, or emergence of payload indicators that could refine the threat profile.