mitrabisnis[.]co

This domain, mitrabisnis.co, is flagged for hosting a brand impersonation phishing campaign targeting users of the e-commerce platform Shopee. Analysis indicates the threat type as a fake login page designed to harvest credentials, classified at an elevated risk level due to its active distribution and detection by multiple security mechanisms. The domain remains offline at the time of assessment, though its prior activity warrants continued monitoring. Infrastructure analysis reveals the following technical indicators: the domain was registered on December 23, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.156.208, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate malicious infrastructure. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited to lend false credibility. Detection metrics show 18 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on at least one security blocklist. The page title explicitly mimics Shopee, reinforcing its intent to deceive users into entering sensitive information. Mitigation measures for this specific threat type include immediate blocking of the domain and its associated IP address at the network perimeter. Organizations should deploy email and web filtering rules to prevent delivery of any messages containing links to mitrabisnis.co or similar impersonation domains. End users should be educated to verify URLs before entering credentials, particularly for platforms like Shopee, and to inspect SSL certificate details for inconsistencies. Security teams are advised to monitor for related domains registered through Gname.com Pte. Ltd. or resolving to Cloudflare IP ranges, as these may indicate follow-up campaigns. Credential resets should be enforced for any accounts potentially exposed to this phishing attempt.