shopei[.]vip

This domain, shopei.vip, is actively engaged in phishing operations designed to mimic legitimate e-commerce checkout processes, likely targeting users during payment transactions. Analysis indicates the site presents fraudulent payment forms to harvest credit card details, login credentials, and personal information under the guise of a trusted shopping platform. The infrastructure is engineered to deceive users into entering sensitive data, which is then exfiltrated to attacker-controlled servers for financial fraud or identity theft. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain was registered on March 12, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.74.237, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate attacker infrastructure. Detection metrics further substantiate the threat: VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while three independent security blocklists—including PhishDestroy, MetaMask, and SEAL—have issued active warnings. The SSL certificate, issued by Let’s Encrypt (serial number E7), provides encrypted connections but does not validate legitimacy, as phishing sites routinely abuse free certificate authorities to appear trustworthy. Users who have visited shopei.vip or entered credentials on the site should immediately cease all interaction and take corrective measures. All exposed passwords, payment details, and personal information must be considered compromised and should be changed from a secure, unaffected device. Financial institutions should be notified to monitor for unauthorized transactions, and credit reports should be reviewed for signs of identity theft. Browser caches and cookies should be cleared to remove any residual tracking mechanisms. Given the domain’s high-risk classification and active status, organizations are advised to implement network-level blocking of 104.21.74.237 and shopei.vip to prevent further exposure.