ywgsgs765[.]vis3367[.]shop

This domain, ywgsgs765.vis3367.shop, is identified as a high-risk phishing site impersonating the Shopee e-commerce platform. The page title explicitly mimics the legitimate Shopee brand, suggesting an intent to deceive users into entering credentials or financial information under false pretenses. Analysis indicates the site employs social engineering tactics, as confirmed by Google Safe Browsing's SOCIAL_ENGINEERING flag, to manipulate victims into disclosing sensitive data, likely for fraudulent transactions or account takeovers.

Technical evidence supports the classification of this domain as malicious. The domain is flagged by 18 out of 95 security vendors on VirusTotal, indicating broad consensus among threat intelligence providers. Infrastructure analysis reveals the site was hosted on Nginx and employed Vue.js for frontend development, alongside HSTS (HTTP Strict Transport Security) to feign legitimacy. The domain resolved to the IP address 154.23.224.17 and was listed on one security blocklist prior to being taken offline. While the registrar details are not explicitly provided, the domain's structure and rapid takedown suggest it was part of a short-lived phishing campaign.

Users who visited ywgsgs765.vis3367.shop should take immediate remedial action. If any credentials or payment details were entered, affected individuals must change passwords for all associated accounts, particularly those linked to Shopee or other e-commerce platforms. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor financial statements for unauthorized transactions and report suspicious activity to relevant financial institutions. Additionally, scan local devices for malware using updated security tools to ensure no secondary infections were introduced during the visit.