shopeevip[.]vip

The domain shopeevip.vip is assessed as a high-risk fake login phishing site. This evaluation is based on multiple indicators of compromise and the domain's current active status, which poses a significant threat to users attempting to log into what they believe is a legitimate service.

Analysis indicates that shopeevip.vip is flagged by 15 out of 95 security vendors on VirusTotal, suggesting a consensus among security professionals regarding its malicious nature. The domain was registered through NameMart Pte. Ltd. on January 23, 2026, and is currently active. It resolves to the IP address 148.66.3.116, which is located in Hong Kong and is associated with AS45753 Netsec Limited. The SSL certificate is issued by Let's Encrypt, which is a common tactic to gain user trust. Additionally, the domain appears on two security blocklists and is flagged as a phishing site by Google Safe Browsing. It is also blocked by PhishDestroy and OpenPhish, further corroborating its malicious intent. These findings collectively suggest that the domain is being used to conduct phishing attacks, likely targeting users of legitimate e-commerce platforms.

To mitigate the risks associated with this fake login phishing domain, it is recommended that organizations update their security blocklists to include shopeevip.vip and educate users about the signs of phishing, such as unexpected login prompts and suspicious URLs. Technical teams should monitor network traffic for connections to this IP address and implement DNS filtering to prevent access. Users should be advised to verify the legitimacy of any login pages by checking the URL and SSL certificate, and to report any suspicious activity to their IT departments. Regular security audits and user training on phishing threats are essential to maintaining a secure environment.