go-entregas-ze24h[.]shop

The domain go-entregas-ze24h.shop is actively involved in a phishing campaign, impersonating ZE Express. The site is flagged by 7 out of 91 VirusTotal vendors, indicating a significant threat level. It is hosted on IP 88.80.17.179 in Sweden, under the organization Fredrik Holmqvist. The domain was registered through Dynadot Inc. and uses an SSL certificate issued by Let's Encrypt.

PhishDestroy's systems detected this domain on June 19, 2026, shortly after its creation on June 6, 2026. This rapid detection highlights the efficiency of PhishDestroy's monitoring pipeline, which identifies threats before they are widely recognized by antivirus vendors. The domain's platform risk score is high, at 83 out of 100, underscoring its potential danger.

The phishing site masquerades as ZE Express, a service offering cold beverages, to deceive users into divulging sensitive information. Despite being listed on only one public blocklist, the domain's malicious intent is clear from its VirusTotal detections. This case exemplifies how phishing domains exploit the early days post-registration to conduct fraudulent activities before comprehensive detection by security tools.