info-resmi846[.]blogspot[.]com

This domain is flagged for elevated-risk credential theft activity targeting users of the e-commerce platform Shopee. Analysis indicates the site operated as a fraudulent login portal, designed to harvest user credentials through brand impersonation. The threat type is classified specifically as credential theft, with no evidence of cryptocurrency drainer or payment interception functionality observed in this campaign. Infrastructure analysis reveals the domain info-resmi846.blogspot.com was registered through the Google Blogger platform, leveraging its hosting infrastructure. The site resolved to the IPv6 address 2a00:1450:4001:c25::84, associated with Google's content delivery network. Detection metrics include 17 out of 95 security vendors flagging the domain on VirusTotal, while PhishDestroy maintains an active block. The domain appears on one security blocklist, and Gridinsoft assigned a trust score of 0/100. The SSL certificate is issued by Google Trust Services, and detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3. The page title explicitly used the brand name 'Shopee,' reinforcing its impersonation objective. Mitigation steps for this credential theft campaign include immediate revocation of any credentials entered on the site, followed by password resets across all platforms where identical login details may have been reused. Organizations should update web filtering rules to block the domain and its associated IP address range. Users are advised to verify domain authenticity by checking for HTTPS validity and official branding elements before entering login information. Security teams should monitor for secondary phishing attempts, as credential theft often precedes follow-up attacks such as account takeovers or fraudulent transactions. Network defenders may correlate the IPv6 address with other known malicious domains to identify broader campaign infrastructure.