g8nwjp-he[.]myshopify[.]com

The domain g8nwjp-he.myshopify.com poses a significant threat as it is involved in brand impersonation activities, specifically targeting the brand 'base'. The domain was designed to mislead users into believing they were interacting with a legitimate support or service page under the guise of 'Central • Atendimento'. This malicious setup aims to harvest sensitive information by exploiting trust in the brand identity it seeks to replicate.

Technical analysis reveals that this domain is detected by 14 out of 95 security vendors on VirusTotal, highlighting its widespread recognition as a threat. The domain was registered through SHOPIFY-NET (ASN: 13335) and has been flagged on 2 known security blocklists, namely PhishDestroy and PhishingDB. It resolves to the IP address 185.199.109.153, hosted by AS54113 Fastly, Inc. in the United States. The SSL certificate is issued by Let's Encrypt, a free certificate authority, which aligns with common practices for quickly establishing seemingly secure phishing sites.

Users who may have interacted with g8nwjp-he.myshopify.com should immediately scan their devices for malware and update their passwords to secure accounts potentially compromised by the phishing attack. It is also advisable to enable two-factor authentication wherever possible to add an extra layer of security. Organizations are encouraged to inform their staff about such threats and ensure that security awareness training includes identifying signs of brand impersonation and other phishing tactics.