Shein

E-commerce & retail Singaporeshein.comRank 483 of the most impersonated
Cert findings · 24 h
1
Cert findings · 7 days
22
22 on phishing hosts
Registered lookalikes
312
15 listed by a source or an address list
Official domains
10
verified from Shein's own sites and records

Certificate findings for Shein

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Shein's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 24 findings, grouped by hostname

  1. shein.men US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 6 y ago
    DetailsHide
    Hostname
    shein.men
    First seen
    2026-11-05 08:59 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 216.245.213.74.
    1. Phishing-host list fetched with the address
    2. Resolved to 216.245.213.74
    Brand
    Shein
    Addresses
    216.245.213.74 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    216.245.213.76 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    shein.men
    Registered
    2020-07-28 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

  2. pagamentos-shein.online DE · AS212317 · HETZNER-CLOUD3-AS Hetzner O…5 addresses
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    pagamentos-shein.online
    First seen
    2026-11-03 01:42 UTC
    First published
    2026-11-03 08:50 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.78.156.59.
    1. Resolved to 5.78.156.59
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Shein
    Addresses
    5.78.156.59 · Germany · AS212317 HETZNER-CLOUD3-AS Hetzner Online GmbH
    5.161.47.86 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    5.161.230.87 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    46.62.237.138 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    195.201.128.179 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (46.62.237.138, 195.201.128.179): a cloud provider. It rents servers and addresses to its customers.
    Domain
    pagamentos-shein.online
    Registered
    2026-07-07 · VIRTUA DRUG Kutatási Szolgáltató Korlátolt Felelősségű Társaság
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  3. www.sheinexchange.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    www.sheinexchange.com.br
    First seen
    2026-11-03 00:11 UTC
    First published
    2026-11-03 00:21 UTC
    DNS
    Resolves · checked 2026-11-05 00:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 22:59 UTC to 2027-01-31 22:59 UTC
    Logged 2026-11-02 23:57 UTC in Let's Encrypt Sycamore2027h1, entry 912,019,479
    SHA-256 6df175288ae5805415dd5e615704810726bef416b3ae53f9df4f2926a360f7c7
    Public key SHA-256 a3f843776941c673684f6a902140efa7c855cc347fc83f21946a0156562aebf5
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    sheinexchange.com.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  4. sheinexchange.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    sheinexchange.com.br
    First seen
    2026-11-03 00:11 UTC
    First published
    2026-11-03 00:21 UTC
    DNS
    Resolves · checked 2026-11-05 00:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 22:59 UTC to 2027-01-31 22:59 UTC
    Logged 2026-11-02 23:57 UTC in Let's Encrypt Sycamore2027h1, entry 912,019,479
    SHA-256 6df175288ae5805415dd5e615704810726bef416b3ae53f9df4f2926a360f7c7
    Public key SHA-256 a3f843776941c673684f6a902140efa7c855cc347fc83f21946a0156562aebf5
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    sheinexchange.com.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  5. www.sheinstore.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    www.sheinstore.com.br
    First seen
    2026-11-03 00:07 UTC
    First published
    2026-11-03 00:21 UTC
    DNS
    Resolves · checked 2026-11-05 00:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 23:02 UTC to 2027-01-31 23:02 UTC
    Logged 2026-11-03 00:00 UTC in IPng Networks Gouda2027h1, entry 297,512,984
    SHA-256 bebb56d1e680c0f3144efeca260a0debb8442daf48bec97122eb31c3ee48dcc6
    Public key SHA-256 c2b60aa0dac8f6e15aecac863f7227439e1a9d76df7a1db3b2a06c2876bc84f8
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    sheinstore.com.br
    Registered
    2022-10-03
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  6. www.sheingroup.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    www.sheingroup.com.br
    First seen
    2026-11-03 00:07 UTC
    First published
    2026-11-03 00:21 UTC
    DNS
    Resolves · checked 2026-11-05 00:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 23:05 UTC to 2027-01-31 23:05 UTC
    Logged 2026-11-03 00:03 UTC in Let's Encrypt Sycamore2027h1, entry 912,099,157
    SHA-256 35bc5424a7dade327614d10d9993cbf056ebf2ae7c85c8b6ebaecf43be7dbf56
    Public key SHA-256 7f448af456e60690cf5ab6b9766445569fe68ebb07de6aa2fc00c1afbe9cf5db
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    sheingroup.com.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  7. sheinstore.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    sheinstore.com.br
    First seen
    2026-11-03 00:07 UTC
    First published
    2026-11-03 00:21 UTC
    DNS
    Resolves · checked 2026-11-05 00:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 23:02 UTC to 2027-01-31 23:02 UTC
    Logged 2026-11-03 00:00 UTC in IPng Networks Gouda2027h1, entry 297,512,984
    SHA-256 bebb56d1e680c0f3144efeca260a0debb8442daf48bec97122eb31c3ee48dcc6
    Public key SHA-256 c2b60aa0dac8f6e15aecac863f7227439e1a9d76df7a1db3b2a06c2876bc84f8
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    sheinstore.com.br
    Registered
    2022-10-03
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  8. sheingroup.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    sheingroup.com.br
    First seen
    2026-11-03 00:07 UTC
    First published
    2026-11-03 00:21 UTC
    DNS
    Resolves · checked 2026-11-05 00:28 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 23:05 UTC to 2027-01-31 23:05 UTC
    Logged 2026-11-03 00:03 UTC in Let's Encrypt Sycamore2027h1, entry 912,099,157
    SHA-256 35bc5424a7dade327614d10d9993cbf056ebf2ae7c85c8b6ebaecf43be7dbf56
    Public key SHA-256 7f448af456e60690cf5ab6b9766445569fe68ebb07de6aa2fc00c1afbe9cf5db
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    sheingroup.com.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  9. www.shein.ind.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    www.shein.ind.br
    First seen
    2026-11-02 23:57 UTC
    First published
    2026-11-03 00:09 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-02 22:53 UTC to 2027-01-31 22:53 UTC
    Logged 2026-11-02 23:52 UTC in Google PlumbersArms2027h1, entry 581,011,119
    SHA-256 87fe9b2a5b3b96920fcf004cd2bcf246ba5fd431b51455c45a94143208b3795c
    Public key SHA-256 64286afe6dd0a500250694777bd4a30dd87aee34927fafc8222991fc1b159e4f
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    shein.ind.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  10. shein.ind.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    shein.ind.br
    First seen
    2026-11-02 23:57 UTC
    First published
    2026-11-03 00:09 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-02 22:53 UTC to 2027-01-31 22:53 UTC
    Logged 2026-11-02 23:52 UTC in Google PlumbersArms2027h1, entry 581,011,119
    SHA-256 87fe9b2a5b3b96920fcf004cd2bcf246ba5fd431b51455c45a94143208b3795c
    Public key SHA-256 64286afe6dd0a500250694777bd4a30dd87aee34927fafc8222991fc1b159e4f
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    shein.ind.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  11. www.sheinbr.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    www.sheinbr.com.br
    First seen
    2026-11-02 23:52 UTC
    First published
    2026-11-03 00:09 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 22:47 UTC to 2027-01-31 22:47 UTC
    Logged 2026-11-02 23:46 UTC in Let's Encrypt Sycamore2027h1, entry 911,891,460
    SHA-256 20e6b917837f2b0df13dc7fb5b93d3a375df5f33c8689954623d357f6b1c9891
    Public key SHA-256 9a162fdfb026fbdeb6fb301d033e7f34ec1f3f3515249635f5fbea42784ec964
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    sheinbr.com.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  12. www.shein.net.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    www.shein.net.br
    First seen
    2026-11-02 23:52 UTC
    First published
    2026-11-03 00:09 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 22:50 UTC to 2027-01-31 22:50 UTC
    Logged 2026-11-02 23:49 UTC in Geomys Tuscolo2027h1, entry 451,520,534
    SHA-256 73fd08b8effa6245ef4b2b8e994b6806acfdd2073e48628cf54316e92bc429a6
    Public key SHA-256 346823e003bb6594290a97d7a6de6c94b8147a83caa332742d48beb9de91624d
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    shein.net.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  13. www.shein.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 8 y ago
    DetailsHide
    Hostname
    www.shein.com.br
    First seen
    2026-11-02 23:52 UTC
    First published
    2026-11-03 00:09 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-02 22:47 UTC to 2027-01-31 22:47 UTC
    Logged 2026-11-02 23:46 UTC in Google PlumbersArms2027h1, entry 580,934,133
    SHA-256 4660a9da67c404d83b7c86c59b7d26fc52c3f1f1d820577fcc4cb32bf8795ea5
    Public key SHA-256 19b9f8238a4f64d49c9c14effdc2e6a0deaa7f90917a5cf57629bebb52a121bb
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    shein.com.br
    Registered
    2019-02-27
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  14. sheinbr.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    sheinbr.com.br
    First seen
    2026-11-02 23:52 UTC
    First published
    2026-11-03 00:09 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 22:47 UTC to 2027-01-31 22:47 UTC
    Logged 2026-11-02 23:46 UTC in Let's Encrypt Sycamore2027h1, entry 911,891,460
    SHA-256 20e6b917837f2b0df13dc7fb5b93d3a375df5f33c8689954623d357f6b1c9891
    Public key SHA-256 9a162fdfb026fbdeb6fb301d033e7f34ec1f3f3515249635f5fbea42784ec964
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    sheinbr.com.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  15. shein.net.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    shein.net.br
    First seen
    2026-11-02 23:52 UTC
    First published
    2026-11-03 00:09 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 22:50 UTC to 2027-01-31 22:50 UTC
    Logged 2026-11-02 23:49 UTC in Geomys Tuscolo2027h1, entry 451,520,534
    SHA-256 73fd08b8effa6245ef4b2b8e994b6806acfdd2073e48628cf54316e92bc429a6
    Public key SHA-256 346823e003bb6594290a97d7a6de6c94b8147a83caa332742d48beb9de91624d
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    shein.net.br
    Registered
    2022-10-14
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  16. shein.com.br BR · AS22548 · Nucleo de Inf. e Coord. do …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC rejectRegistered 8 y ago
    DetailsHide
    Hostname
    shein.com.br
    First seen
    2026-11-02 23:52 UTC
    First published
    2026-11-03 00:09 UTC
    DNS
    Resolves · checked 2026-11-05 00:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 200.160.2.95.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 200.160.2.95
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-02 22:47 UTC to 2027-01-31 22:47 UTC
    Logged 2026-11-02 23:46 UTC in Google PlumbersArms2027h1, entry 580,934,133
    SHA-256 4660a9da67c404d83b7c86c59b7d26fc52c3f1f1d820577fcc4cb32bf8795ea5
    Public key SHA-256 19b9f8238a4f64d49c9c14effdc2e6a0deaa7f90917a5cf57629bebb52a121bb
    Brand
    Shein
    Addresses
    200.160.2.95 · Brazil · AS22548 AS22548 - Nucleo de Inf. e Coord. do Ponto BR - NIC.BR
    Domain
    shein.com.br
    Registered
    2019-02-27
    MX
    Publishes no mail exchanger
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  17. www.shein888.vip CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 d ago
    DetailsHide
    Hostname
    www.shein888.vip
    First seen
    2026-11-02 15:52 UTC
    First published
    2026-11-02 16:54 UTC
    DNS
    Resolves · checked 2026-11-04 16:58 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 14:48 UTC to 2027-01-31 14:48 UTC
    Logged 2026-11-02 15:46 UTC in IPng Networks Gouda2027h1, entry 294,579,262
    SHA-256 afecbe287282e4961a4b457b1425b7647ed72732b1e04a9d549bc475571365ba
    Public key SHA-256 3d1fc6cbbb0bc07e53fabeb2fb45f3e9f6e21ab485e5dc32a68e825069dca74e
    Brand
    Shein
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    shein888.vip
    Registered
    2026-11-02 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  18. shein888.vip CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 d ago
    DetailsHide
    Hostname
    shein888.vip
    First seen
    2026-11-02 15:52 UTC
    First published
    2026-11-02 16:54 UTC
    DNS
    Resolves · checked 2026-11-04 16:58 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 14:48 UTC to 2027-01-31 14:48 UTC
    Logged 2026-11-02 15:46 UTC in IPng Networks Gouda2027h1, entry 294,579,262
    SHA-256 afecbe287282e4961a4b457b1425b7647ed72732b1e04a9d549bc475571365ba
    Public key SHA-256 3d1fc6cbbb0bc07e53fabeb2fb45f3e9f6e21ab485e5dc32a68e825069dca74e
    Brand
    Shein
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    shein888.vip
    Registered
    2026-11-02 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 17:09 UTC

    Suggest a correction

  19. www.shein88.my CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.shein88.my
    First seen
    2026-11-02 09:52 UTC
    First published
    2026-11-02 10:48 UTC
    DNS
    Resolves · checked 2026-11-04 11:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-02 08:50 UTC to 2027-01-31 08:50 UTC
    Logged 2026-11-02 09:48 UTC in Google ParcelYard2027h1, entry 569,638,538
    SHA-256 0f12bf38e6a99f436fcac28c09604ed5fdf1d77906df34ca3ed3e2490dfb6336
    Public key SHA-256 6e65a461f1b693ba17ec0025c9701c1e591278e2bce1fffed5e7d1d3cd0751bb
    Brand
    Shein
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    shein88.my
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  20. shein88.my CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    shein88.my
    First seen
    2026-11-02 09:52 UTC
    First published
    2026-11-02 10:48 UTC
    DNS
    Resolves · checked 2026-11-04 11:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-02 08:50 UTC to 2027-01-31 08:50 UTC
    Logged 2026-11-02 09:48 UTC in Google ParcelYard2027h1, entry 569,638,538
    SHA-256 0f12bf38e6a99f436fcac28c09604ed5fdf1d77906df34ca3ed3e2490dfb6336
    Public key SHA-256 6e65a461f1b693ba17ec0025c9701c1e591278e2bce1fffed5e7d1d3cd0751bb
    Brand
    Shein
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    shein88.my
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  21. www.sistema-shein.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 23 mo ago
    DetailsHide
    Hostname
    www.sistema-shein.online
    First seen
    2026-10-31 20:06 UTC
    First published
    2026-10-31 21:14 UTC
    DNS
    Resolves · checked 2026-11-04 21:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-31 19:03 UTC to 2027-01-29 19:03 UTC
    Logged 2026-10-31 20:01 UTC in Google PlumbersArms2027h1, entry 544,867,343
    SHA-256 88f0e8bb06aa5e087ee701243736bc96c730889fee0a06e32323a317a74dacce
    Public key SHA-256 4bcd95a5ab6f49d9455e591e1490829b24aba01af7514b5843812048e629aee1
    Brand
    Shein
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    sistema-shein.online
    Registered
    2024-12-30 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:36 UTC

    Suggest a correction

  22. sistema-shein.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 23 mo ago
    DetailsHide
    Hostname
    sistema-shein.online
    First seen
    2026-10-31 20:06 UTC
    First published
    2026-10-31 21:14 UTC
    DNS
    Resolves · checked 2026-11-04 21:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-31 19:03 UTC to 2027-01-29 19:03 UTC
    Logged 2026-10-31 20:01 UTC in Google PlumbersArms2027h1, entry 544,867,343
    SHA-256 88f0e8bb06aa5e087ee701243736bc96c730889fee0a06e32323a317a74dacce
    Public key SHA-256 4bcd95a5ab6f49d9455e591e1490829b24aba01af7514b5843812048e629aee1
    Brand
    Shein
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    sistema-shein.online
    Registered
    2024-12-30 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:36 UTC

    Suggest a correction

  23. www.atendimento-shein-online.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    www.atendimento-shein-online.online
    First seen
    2026-10-28 15:06 UTC
    First published
    2026-10-28 15:12 UTC
    DNS
    Resolves · checked 2026-11-04 15:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-28 14:05 UTC to 2027-01-26 14:05 UTC
    Logged 2026-10-28 15:03 UTC in DigiCert Wyvern2027h1, entry 335,452,092
    SHA-256 5262ad5319ba0f6ba6d1615875a9785b1709838176e54a679bb8856a3e8f11eb
    Public key SHA-256 9c218630d9586964bf7611b1ed92c74072b273bb90330809b23392eecd5ddedd
    Brand
    Shein
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    atendimento-shein-online.online
    Registered
    2025-11-30 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:36 UTC

    Suggest a correction

  24. atendimento-shein-online.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 11 mo ago
    DetailsHide
    Hostname
    atendimento-shein-online.online
    First seen
    2026-10-28 15:05 UTC
    First published
    2026-10-28 15:12 UTC
    DNS
    Resolves · checked 2026-11-04 15:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-28 14:05 UTC to 2027-01-26 14:05 UTC
    Logged 2026-10-28 15:03 UTC in DigiCert Wyvern2027h1, entry 335,452,092
    SHA-256 5262ad5319ba0f6ba6d1615875a9785b1709838176e54a679bb8856a3e8f11eb
    Public key SHA-256 9c218630d9586964bf7611b1ed92c74072b273bb90330809b23392eecd5ddedd
    Brand
    Shein
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    atendimento-shein-online.online
    Registered
    2025-11-30 · HOSTINGER operations, UAB
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 02:36 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Shein when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in E-commerce & retail

All brands →