pk5y7u[.]top

This domain, pk5y7u.top, is flagged for brand impersonation targeting Stripe, a widely used payment processing platform. Analysis indicates the site masquerades as a legitimate Stripe portal, likely to harvest credentials or facilitate unauthorized transactions. The page title, "Shopee," suggests an attempt to blend with e-commerce activity, though the domain structure and hosting pattern align with known payment fraud infrastructure. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Namemart Limited. It resolves to the IP address 180.178.44.99, hosted on AS45753 (Netsec Limited) in Hong Kong. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist, and no Google Safe Browsing (GSB) detections are recorded at this time. The domain is currently offline, likely due to takedown actions or infrastructure changes. However, residual risk remains as threat actors may re-deploy the domain or shift to newly registered lookalikes. Defenders should monitor for similar domains using the same registrar or IP range, particularly those impersonating financial services. Network-level blocking of the IP 180.178.44.99 and domains registered via Namemart Limited around the creation date is recommended to mitigate further exposure.