seller[.]shopeac[.]cc

This domain, seller.shopeac.cc, is identified as an active credential theft operation targeting users of a widely recognized e-commerce platform. Analysis indicates the site impersonates the legitimate Store App interface associated with Shopee, a regional online marketplace. The phishing page employs social engineering tactics to harvest user credentials, likely through a fabricated login portal designed to replicate the authentic platform's appearance. No direct evidence of a crypto drainer kit or wallet interception script was observed, but the credential theft mechanism remains a high-risk vector for subsequent account takeover or financial fraud. Infrastructure analysis reveals the domain was registered on June 25, 2024, through Dominet (HK) Limited, a registrar frequently associated with malicious registrations. The domain resolves to the IP address 79.99.78.100, which has been linked to prior phishing campaigns in recent months. Detection metrics indicate moderate but concerning coverage, with 10 out of 95 security vendors on VirusTotal flagging the domain as malicious. Google Safe Browsing has classified the site under the SOCIAL_ENGINEERING category, confirming its deceptive nature. Additional blocklist monitoring services report the domain as active on at least three other threat intelligence feeds, though exact counts vary by source. As of the latest verification, seller.shopeac.cc remains operational, with no evidence of takedown or registrar intervention. The SSL certificate, issued by Let's Encrypt, provides a veneer of legitimacy but does not mitigate the underlying threat. Users are advised to avoid interacting with the domain, particularly inputting login credentials or personal information. Organizations should update web filtering rules to block access to 79.99.78.100 and the domain itself, while monitoring for indicators of compromise among users who may have engaged with the site. The remaining risk is classified as high due to the domain's active status, targeted impersonation of a trusted brand, and the potential for credential abuse in downstream attacks.