go-pedidosze-24h[.]shop

This domain, go-pedidosze-24h.shop, is flagged as a high-risk phishing portal targeting users of ZE Express, a beverage delivery service. Analysis indicates the site presents itself as a legitimate order platform under the title 'ZE Express | Bebidas geladas,' aiming to harvest payment credentials and personal data from unsuspecting customers. No specific drainer kit signatures have been identified, but the infrastructure aligns with common phishing deployment patterns observed in recent campaigns. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on June 16, 2026, through Dynadot Inc., an uncommon future date suggesting potential domain spoofing or registry manipulation. It resolves to IP 88.80.17.179, hosted in Sweden under AS33837 (Fredrik Holmqvist), a network segment frequently associated with malicious activity. The SSL certificate is issued by Let's Encrypt (YR1), a legitimate provider often abused by threat actors. VirusTotal detection shows 9 out of 95 security vendors flagging the domain, while it appears on one active security blocklist. Google Safe Browsing currently does not list the domain, indicating a potential gap in automated detection coverage. As of the latest assessment, go-pedidosze-24h.shop remains active and operational, posing an ongoing threat to users. Immediate response actions include blocking the domain at the DNS level and monitoring for associated IP or certificate reuse in new phishing campaigns. The remaining risk is classified as high due to the domain's active status, low detection coverage, and direct targeting of consumer payment data. Organizations are advised to update web filtering rules to include this domain and its resolving IP, while users should be alerted to avoid interaction with any ZE Express-related sites not originating from verified official channels.