go-pedidos48h-ze[.]shop

This domain, go-pedidos48h-ze.shop, is flagged as a high-risk credential harvesting phishing site impersonating ZE Express, a beverage delivery service. The page title 'ZE Express | Bebidas geladas' suggests a localized phishing campaign targeting Portuguese-speaking users, likely aiming to harvest login credentials, payment details, or personal information under the guise of a legitimate express delivery service. No specific drainer kit signatures have been identified, but the domain follows a pattern consistent with generic phishing infrastructure designed for rapid deployment and short-term use. Analysis indicates the domain was registered on June 17, 2026, through Dynadot Inc., and currently resolves to the IP address 88.80.17.179, hosted on AS33837 (Fredrik Holmqvist, Sweden). VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (YR2), a common choice for phishing sites due to its low-cost and automated issuance process. Google Safe Browsing (GSB) has not yet listed the domain, indicating a potential gap in detection coverage for this threat. The domain remains active as of the latest verification, with no evidence of takedown or sinkholing. Response actions should include immediate blacklisting of the domain and IP in enterprise security tools, as well as monitoring for related infrastructure (e.g., subdomains, similar naming patterns). The remaining risk is high due to the domain's active status, low detection rate among security vendors, and the use of a legitimate SSL certificate, which may lend a false sense of security to targeted users. Organizations are advised to block access to this domain at the DNS or proxy level and alert users to the threat, particularly those in regions where ZE Express operates.