shopeescs[.]vip

This domain is flagged as an elevated-risk credential theft phishing site designed to harvest user login credentials by impersonating the legitimate Shopee e-commerce platform. Analysis indicates the site employs a deceptive login interface to trick victims into entering sensitive account details, which are then exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals the domain shopeescs.vip was registered on November 17, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to the IP address 23.94.74.141 and is detected by 14 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and has been included in one AlienVault OTX threat intelligence pulse. Additional technical indicators include the use of Vue.js for frontend development, Nginx as the web server, and support for HSTS and HTTP/3 protocols. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. The page title explicitly mimics Shopee’s branding, reinforcing its fraudulent intent. To mitigate the risk posed by this credential theft operation, organizations should immediately block the domain and its associated IP (23.94.74.141) at the network perimeter. End users who may have interacted with the site should be instructed to reset their Shopee account passwords and enable multi-factor authentication (MFA) on all critical accounts. Security teams should monitor for signs of credential reuse across other platforms, as compromised login details are often leveraged in secondary attacks. Additionally, domain registrars and hosting providers should be notified of the abuse to facilitate takedown procedures. Proactive threat hunting for related domains registered under the same registrar or resolving to the same IP range is recommended to identify potential follow-up campaigns.