ze-bebidas[.]click

The domain ze-bebidas.click is currently flagged as an active credential phishing site designed to impersonate ZE Express, a beverage delivery service. Analysis indicates the page title "ZE Express | Bebidas geladas" is used to deceive users into believing they are interacting with a legitimate platform for cold beverage orders. The site remains operational and poses a high risk for credential theft and financial fraud targeting Portuguese-speaking users. Infrastructure analysis reveals the domain was registered on June 27, 2026, through Dynadot, LLC, an uncommon registration date suggesting potential domain spoofing or typo-squatting. The domain resolves to the IP address 88.80.17.179, which has been associated with previous phishing campaigns. Detection metrics show the domain is flagged by 15 of 95 security vendors on VirusTotal, indicating moderate but growing awareness within the security community. No additional blocklist entries or trust scores were identified at the time of analysis. The site remains active and continues to host phishing content. Organizations and users are advised to block the domain and IP address at the network level. End-users should avoid interacting with the site, particularly those expecting communications from ZE Express. Security teams are recommended to monitor for related domains registered through the same registrar or resolving to the same IP, as these may indicate a broader campaign. Immediate reporting to relevant abuse contacts at the hosting provider and registrar is strongly advised to facilitate takedown efforts.