donhangshopee.click
Appeared in the .click zone on Saturday, September 19, 2026; by the end of that day the census found active website about e-commerce & retail. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Page is a Vietnamese internal operations dashboard ("Agent Đơn Hàng Shopee") for a specific seller (sakuko_official / sakuko_official_store) with Lark Base integration, user/role management and run logs — its login is for the tool's own accounts, not a replica of Shopee's login; it is served over a Cloudflare Tunnel from a home/office host (Error 1033 today), which fits a self-hosted seller tool rather than a credential-harvesting phish.
Domain name contains 'shopee' and page title is 'Agent Đơn Hàng Shopee' (Shopee Order Agent). The cached text shows a login form ('Đăng nhập để tiếp tục' = Sign in to continue) with username and password fields, plus a full dashboard interface mimicking a Shopee seller/agent management portal with order lists, user management, and AI automation features. This impersonates Shopee's infrastructure to harvest credentials. The current Cloudflare error does not negate the phishing intent demonstrated
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Saturday, September 19, 2026
Same data as JSON: /api/zone/domain/donhangshopee.click. This page is not indexed by search engines and does not link to the site it describes.