baucarshopee1441[.]weebly[.]com

Analysis of the domain baucarshopee1441.weebly.com indicates it was operating as an e-commerce scam targeting users with a fraudulent Shopee storefront. The page title 'shopee - Home' explicitly suggests an attempt to impersonate the Shopee brand, though no further content analysis is available to confirm specific tactics such as payment interception or credential harvesting. The domain was hosted on Weebly infrastructure (AS27647, US) and resolved to IP 74.115.51.8 at the time of detection. It used a Let's Encrypt SSL certificate (E8) and was proxied through Cloudflare, a common evasion tactic to obscure hosting details. The domain was flagged by 14 of 95 security vendors on VirusTotal and appeared on one security blocklist, including PhishDestroy.

Despite its creation date of March 29, 2006, this appears to be a case of domain repurposing, as the infrastructure and detection timeline align with recent phishing activity. The HTTP status returned a 404 at the time of assessment, and the domain has since been taken offline. Nameservers were hosted on AWS (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns), which is consistent with legitimate services but does not preclude malicious use. Defenders should treat this domain as part of a broader e-commerce fraud campaign.

While the site is offline, the infrastructure (Weebly, Cloudflare, AWS nameservers) and SSL certificate may be reused in future attacks. Monitoring for similar subdomains or repurposed Weebly pages with e-commerce themes is recommended. No evidence suggests this domain was part of a larger phishing kit or automated campaign, but the use of Cloudflare and Let's Encrypt aligns with common phishing tradecraft. The registrar, Safenames Ltd, has no documented history of abuse in this case, but defenders should verify whether other domains from the same registrant exhibit similar patterns.