layanan-shopee43[.]blogspot[.]com

On July 26 2026 the domain layanan-shopee43.blogspot.com was observed as an active generic phishing infrastructure. The domain is hosted on the Blogger platform and registered through Google LLC, indicating a free‑service registration. DNS resolution returns the IPv4 address 192.178.183.132; the authoritative nameserver query failed, as indicated by the NS_NOT_FOUND entry, which may reflect reliance on Blogger’s internal DNS. The IP address is not presently associated with a known content delivery network and has been observed in a single security blocklist, PhishDestroy, which is currently the only listed blocklist source.

VirusTotal analysis shows that six of ninety‑one scanning engines have flagged the domain as malicious, reinforcing the blocklist indication. No additional intelligence such as Safe Browsing status, OTX references, SSL certificate details, HTTP response codes, or page title information was provided, leaving those aspects unverified. The combination of a registered free‑hosting account, a single blocklist entry, and multiple vendor detections suggests a deliberate attempt to host deceptive content, likely aimed at credential harvesting for the Shopee brand. Defenders should continue to monitor the domain for any changes in resolution, blocklist status, or additional vendor detections.

Network‑level filters may block traffic to the resolved IP address, and endpoint security solutions should incorporate the observed VirusTotal detections. Because the nameserver data is incomplete, further DNS interrogation is recommended to confirm any dynamic updates. Organizations should educate users about unsolicited communications referencing Shopee and advise verification through official channels before entering credentials.