go-pedido24h-ze[.]shop

This domain is flagged as a high-risk credential theft operation designed to harvest user login credentials and payment information under the guise of ZE Express, a legitimate beverage delivery service. Analysis indicates the site employs brand impersonation tactics, presenting itself as the official ZE Express portal with the page title 'ZE Express | Bebidas geladas' to deceive visitors into submitting sensitive data. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain go-pedido24h-ze.shop resolves to the IP address 88.80.17.179, hosted on AS33837 (Fredrik Holmqvist) in Sweden, a network segment previously associated with phishing campaigns. It was registered on June 17, 2024, through Dynadot Inc., a registrar frequently utilized for short-lived malicious domains. The domain appears on at least one security blocklist and is flagged by 7 out of 95 security vendors on VirusTotal, including detections for credential theft. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for threat actors due to its free and automated issuance process. The domain's creation date aligns with typical phishing lifecycle patterns, suggesting it may be part of a larger, ephemeral campaign. Users and organizations are advised to implement mitigation measures specific to credential theft threats. Immediate actions include blocking the domain and its resolving IP (88.80.17.179) at the network perimeter, as well as deploying browser-based warnings for employees or customers attempting to access the site. Given the impersonation of ZE Express, affected users should be instructed to verify the legitimacy of any communication or website claiming affiliation with the brand by cross-referencing official domains and contacting the company through verified channels. Multi-factor authentication (MFA) should be enforced for all accounts to mitigate the impact of stolen credentials. Additionally, security teams are encouraged to monitor for indicators of compromise, such as unusual login attempts or unauthorized transactions, particularly for users who may have interacted with the domain.