brownboxshopee[.]com

The domain brownboxshopee.com is currently active and classified as high‑risk brand‑impersonation targeting ShopeePay. Registration data shows the domain was created on 12 June 2026 through Dynadot Inc, and its authoritative name servers are ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution points to IP 65.9.175.5, which belongs to AS16509 (Amazon.com, Inc.) and is geolocated in Germany. The hosting stack includes Envoy, Amazon Web Services, and Amazon CloudFront, and the presented TLS certificate is an Amazon RSA 2048 M01 certificate. HTTP requests return status 200 and the page title observed is “Brownbox Shopee”, confirming the intended brand reference. Threat‑intel feeds note the domain appears in one AlienVault OTX pulse and is listed on a single public blocklist; it is already blocked by PhishDestroy. VirusTotal analysis shows three of ninety‑one scanners flagged the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The available evidence points to a credential‑phishing campaign designed to harvest ShopeePay credentials. While the page content has not been examined, the combination of brand impersonation, recent registration, cloud‑based infrastructure, and multiple security detections suggests a deliberate malicious operation. Defenders should add brownboxshopee.com to URL and DNS blocklists, monitor outbound traffic for connections to the associated IP address, and enforce multi‑factor authentication for ShopeePay accounts. Continuous threat‑intel monitoring is recommended to capture any evolution of the hosting or payload characteristics.