shopee-money[.]io[.]vn

This domain, shopee-money.io.vn, is actively flagged as a phishing site targeting users of the Shopee platform. As of August 02, 2026, the domain is classified with an elevated risk level and remains operational. Analysis indicates the domain has been detected by 2 of 91 security vendors on VirusTotal, a low but notable detection rate that suggests emerging recognition of its malicious intent. It is also blocked by PhishDestroy and appears on at least one additional security blocklist, reinforcing its classification as a confirmed phishing threat.

Infrastructure analysis reveals the domain is hosted on an ASN and IP range not directly associated with Shopee's official services, though specific hosting details remain unconfirmed. The domain's structure, incorporating 'shopee-money' in its subdomain, strongly suggests an attempt to deceive users into believing it is an official Shopee financial or payment portal. No evidence of a phishing kit or specific page content has been analysed at this stage, though the domain's naming convention aligns with common credential-harvesting tactics. Defenders should treat this domain as a confirmed phishing threat targeting Shopee users.

Immediate action is recommended, including blocking the domain at the DNS or proxy level, updating endpoint protection rules, and alerting users to the risk of financial fraud or account compromise. Further investigation into associated IPs, SSL certificates, and hosting providers may reveal additional infrastructure linked to this campaign. If additional page content or kit details become available, classification may be refined to reflect specific attack vectors or payloads.