ptfuturewebinarfrellanceece[.]net

This domain, ptfuturewebinarfrellanceece.net, is actively impersonating ShopeePay as part of a high-risk phishing operation. Registered on January 19, 2026, through Dominet (HK) Limited, it resolves to IP address 182.16.78.68 and presents a page title matching the brand 'Shopee.' Infrastructure analysis reveals the use of Vue.js, Nginx, Cloudflare, Swiper, jQuery, and cdnjs, indicating a structured frontend likely designed to mimic legitimate payment portals. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, offering no inherent trust signal. Google Safe Browsing has flagged the domain for social engineering, and it appears on three security blocklists, including PhishDestroy and InversionDNS. AlienVault OTX records show the domain in 25 threat intelligence pulses, suggesting widespread detection across multiple security communities. While 18 of 95 security vendors on VirusTotal have flagged the domain, the absence of detections from other vendors does not imply safety—only that analysis is ongoing or detection signatures are still propagating. The domain remains active as of July 12, 2026, with no evidence of takedown or mitigation. Defenders should treat this domain as confirmed malicious and prioritize blocking at DNS, proxy, and endpoint layers. Given the use of Cloudflare, IP-based blocking may be less effective, and domain-based controls are recommended. No specific phishing kit or payload has been publicly attributed to this domain, but the combination of brand impersonation, social engineering flags, and third-party detections justifies immediate containment. Further analysis of network traffic or endpoint logs may reveal additional indicators, such as associated email campaigns or secondary domains.