pedir-delivery-ze[.]shop

This domain is flagged as a high-risk delivery scam, specifically targeting users through fraudulent beverage delivery services under the guise of 'ZE Express | Bebidas geladas.' The infrastructure is designed to deceive victims into entering payment or personal details under false pretenses, a tactic commonly associated with cloned or spoofed delivery platforms. Analysis indicates the domain was registered on June 12, 2026, through Dynadot Inc. and resolves to the IP address 88.80.17.179, hosted on AS33837 (Fredrik Holmqvist, Sweden). Security vendors on VirusTotal flagged the domain with 10/95 detections, while it appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt (YR2), a common choice for malicious actors due to its low barrier to entry. The page title, 'ZE Express | Bebidas geladas,' suggests a localized targeting strategy, likely aimed at Portuguese-speaking users. Mitigation steps for this specific threat type include blocking the domain at the network level, particularly in environments where delivery or e-commerce services are utilized. Organizations should update endpoint protection rules to flag or quarantine communications referencing this domain or its associated IP. Users should be educated to verify delivery notifications directly through official channels, avoiding links or payment requests from unsolicited messages. Monitoring for similar domains registered through the same registrar or resolving to the same IP range may help identify related malicious infrastructure.