go-pede48h-ze[.]shop

This domain, go-pede48h-ze.shop, is flagged as a high-risk phishing site specializing in brand impersonation. Analysis of the page title, 'ZE Express | Bebidas geladas,' indicates a targeted campaign against Brazilian users, mimicking a legitimate delivery service to harvest credentials or payment details. No specific crypto drainer kit signatures were identified, but the generic phishing classification suggests credential theft or financial fraud as the primary objective. The domain does not appear to leverage known phishing frameworks like Angel Drainer or Inferno Drainer, focusing instead on social engineering through fake delivery notifications. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to IP address 88.80.17.99, hosted on AS33837 (Fredrik Holmqvist, Sweden), and was registered through Dynadot Inc. on June 17, 2026. VirusTotal detection rates show 7 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious sites. Google Safe Browsing has not yet listed the domain, leaving a gap in browser-based protections. As of the latest verification, go-pede48h-ze.shop remains active, with no takedown or sinkholing observed. The domain's recent creation date and low blocklist prevalence suggest it may still be in the early stages of deployment. Users are advised to avoid interaction with the site, particularly those receiving unsolicited delivery notifications in Portuguese. Network administrators should consider blocking the IP 88.80.17.99 and monitoring for related domains registered under the same registrar. The remaining risk is classified as high due to the active status, targeted brand impersonation, and limited detection coverage.