info-resmi2477[.]blogspot[.]com

This domain, info-resmi2477.blogspot.com, is identified as a generic phishing site specifically targeting users of the e-commerce platform Shopee. The page title explicitly mimics the legitimate Shopee brand, suggesting an attempt to harvest login credentials, payment details, or personal information through deceptive login portals or fake promotions. No specific drainer kit signatures have been confirmed, but the domain exhibits classic phishing infrastructure characteristics, including the use of a free subdomain service to evade detection and reduce operational costs. Analysis indicates the domain was registered through MarkMonitor, Inc. on February 21, 2026, an anomalous future date that may indicate domain spoofing or registry manipulation. It resolves to the IP address 142.251.141.65, hosted under Google LLC (AS15169), a common tactic to exploit reputable infrastructure for legitimacy. The domain appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal, with detection labels including credential phishing and social engineering. The SSL certificate is issued by Google Trust Services (WE2), providing a false sense of security to potential victims. As of the latest assessment, the domain has been taken offline, likely following detection and reporting by security platforms. However, residual risk remains elevated due to the potential for rehosting under a new subdomain or domain, leveraging the same infrastructure and tactics. Organizations and users are advised to monitor for similar phishing attempts using Shopee branding, particularly those hosted on free subdomain services or reputable cloud providers. Proactive measures include blocking the resolved IP address, updating endpoint protection rules, and educating users on identifying phishing indicators such as mismatched URLs and unsolicited login requests.