shopee[.]click

Analysis of shopee.click indicates an active brand‑impersonation campaign targeting ShopeePay. The site returns HTTP 200 and presents the page title “Shopee”, suggesting an attempt to appear legitimate to users familiar with the Shopee ecosystem. Infrastructure inspection shows the domain resolves to 172.67.197.52, a Cloudflare‑hosted address located in Canada, and is served through the Cloudflare nameservers aiden.ns.cloudflare.com and naya.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 authority, confirming the use of a publicly trusted certificate. Threat intelligence records list the domain on one public blocklist (PhishDestroy) and in a single AlienVault OTX pulse, indicating limited but existing community awareness. VirusTotal scans report detections by 14 of 91 security vendors, reinforcing the malicious nature of the site. The registrar is Global Domain Group LLC. No additional content details have been published, so the exact phishing page layout remains unverified. Defenders should immediately add shopee.click to URL‑filtering deny lists, monitor DNS queries for the domain and its Cloudflare IP range, and consider enabling SSL inspection to capture potential credential submissions. Continuous threat‑intel feeds should be consulted for any new indicators, and incident response teams should be prepared to handle credential theft attempts against ShopeePay users.