distribuidorabebidas-ze[.]shop

This domain, distribuidorabebidas-ze.shop, is identified as part of a credential theft operation impersonating ZE Express, a beverage delivery service. Analysis indicates the infrastructure is designed to harvest login credentials or payment details from unsuspecting users by mimicking the legitimate ZE Express platform, as evidenced by the page title 'ZE Express | Bebidas geladas.' No direct evidence of a crypto drainer kit or other specialized malware was observed, but the credential harvesting focus aligns with broader phishing tactics targeting e-commerce and delivery services. Technical indicators reveal the domain resolves to IP address 88.80.17.179 and uses a Let's Encrypt SSL certificate, a common tactic to lend false legitimacy to phishing sites. VirusTotal detection shows 17 out of 95 security vendors flagging the domain as malicious. The registrar details and domain creation date remain undisclosed, limiting temporal analysis, but the active SSL certificate suggests recent deployment. Google Safe Browsing (GSB) status is not explicitly provided, though the VirusTotal score and active status imply partial blocklisting. No additional blocklist counts are available at this time. The domain remains active as of the latest verification, posing an ongoing risk to users who may mistake it for the legitimate ZE Express service. Response actions should include immediate reporting to hosting providers, certificate authorities, and security vendors to facilitate takedowns. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication (MFA) where available, and cross-reference URLs with official sources. The high-risk classification stems from the domain's active credential theft operations, impersonation of a trusted brand, and partial detection by security vendors, indicating a persistent threat requiring vigilance.