shopee-tbk489[.]blogspot[.]com

shopee-tbk489.blogspot.com was created on 31 July 2000 using the Google Blogger platform. The site is currently classified as an active generic phishing resource with an elevated risk rating. Independent analysis on VirusTotal shows that 16 of 91 security vendors have flagged the domain as malicious, indicating consensus among a subset of scanners. The domain is listed on a single public blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming its inclusion in known anti‑phishing feeds.

Registration through Blogger suggests the underlying infrastructure is hosted on Google’s shared blogging service, which typically provides generic TLS certificates but does not expose dedicated IP ownership information. No additional intelligence such as ASN, country of hosting, SSL certificate details, or HTTP response codes is presently available, leaving the exact hosting footprint uncertain. The limited detection surface—only one blocklist entry and a modest number of vendor detections—does not diminish the observed malicious intent, as the phishing classification is corroborated by the blocklist entry and the vendor consensus. Defenders should ensure that outbound web filters ingest the PhishDestroy blocklist and any other community feeds that list this domain.

Network perimeter devices should be configured to drop or quarantine traffic to shopee-tbk489.blogspot.com, and endpoint security solutions should treat the domain as malicious based on its VirusTotal detection count. Continuous monitoring for new detections or additional blocklist inclusions is advised, as threat actors may evolve the payload or relocate to alternative Blogger subdomains. Until further forensic content analysis is performed, the domain remains a confirmed phishing vector requiring proactive blocking.