shopeee[.]site

Analysis of shopeee.site shows a newly registered domain created on July 30, 2026 through GMO Internet Group, Inc. d/b/a Onamae.com. The domain is currently active and resolves to the IP address 103.221.223.156, hosted on Cloudflare nameservers corey.ns.cloudflare.com and nena.ns.cloudflare.com. It appears on a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that threat‑intelligence providers have already classified the site as malicious.

VirusTotal records show that the domain has been scanned by 91 vendor engines; none returned a detection, but the absence of a detection does not constitute evidence of benign behavior and should be treated as inconclusive. No additional telemetry such as Safe Browsing status, Open Threat Exchange reports, SSL certificate details, HTTP response codes, or page‑title metadata is presently available, leaving the exact content and lure technique of the site unverified. The limited visibility suggests that the infrastructure is newly deployed, possibly to evade early detection.

Defenders should proactively block the domain and its resolved IP at perimeter firewalls and proxy filters, continue to monitor the associated Cloudflare nameservers for future changes, and add the domain to internal phishing‑site watchlists. Ongoing observation of threat‑intel feeds for any emergence of detection signatures or victim reports is recommended, as further evidence may surface that clarifies the specific phishing vector employed by shopeee.site.