adega-bebidas[.]click

This domain, adega-bebidas.click, is actively engaged in credential theft targeting users of the ZE Express brand, a recognized beverage delivery service. Analysis confirms the domain is presently operational and designed to harvest login credentials, payment details, or personal information under the guise of legitimate service offerings. The impersonation of ZE Express is evident through the page title 'ZE Express | Bebidas geladas,' which aligns with the brand’s typical user interface and marketing language. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to the IP address 88.80.17.179 and was registered through Dynadot, LLC on June 27, 2026, an unusually forward-dated creation that may indicate automated or fraudulent registration practices. A Let's Encrypt SSL certificate is present, providing a false sense of security to visitors. VirusTotal reports that 3 of 95 security vendors have flagged this domain as malicious, a low but notable detection rate that suggests emerging or evasive threats. No additional blocklist entries or trust scores were identified at the time of assessment, though the domain’s infrastructure aligns with known phishing patterns. The domain remains active and poses a significant risk to users unfamiliar with ZE Express’s legitimate digital properties. Organizations and individuals are advised to block access to adega-bebidas.click at the network level and update endpoint protection rules to include the domain and its associated IP. Users who may have interacted with the site should immediately reset credentials for any accounts linked to ZE Express or similar services, enable multi-factor authentication, and monitor financial statements for unauthorized activity. Security teams are encouraged to correlate logs for connections to 88.80.17.179 and review associated SSL certificate fingerprints for broader threat hunting.