og6y7c[.]top

This domain, og6y7c.top, is flagged for brand impersonation targeting the e-commerce platform Shopee, specifically mimicking backpack product pages. Analysis indicates the domain was designed to deceive users into believing they were interacting with legitimate Shopee listings, likely to harvest credentials, payment details, or distribute malware. No specific drainer kit signatures were identified, but the page title explicitly matched Shopee’s branding, suggesting a focused phishing campaign. Infrastructure analysis reveals the domain resolved to IP 180.178.44.100, hosted on AS45753 (Netsec Limited) in Hong Kong. It was registered via Namemart Limited on April 8, 2025, and achieved a VirusTotal detection score of 18/95 security vendors. The domain appeared on one security blocklist and was blocked by Google Safe Browsing (GSB) under its SSL certificate issued by Google Trust Services (WE1). These indicators confirm its malicious intent and operational infrastructure. The domain is currently offline, reducing immediate user exposure. However, residual risk persists due to the domain’s recent creation, its presence on blocklists, and the potential for re-activation or migration to new infrastructure. Organizations should monitor for related IOCs, including the IP 180.178.44.100 and SSL certificate thumbprints, and update detection rules to prevent future compromise attempts. Users who accessed the domain should verify account activity and reset credentials as a precaution.