shopee9699[.]blogspot[.]com

PhishDestroy flags shopee9699.blogspot.com as an active, elevated-risk replica storefront phishing site designed to impersonate the legitimate Shopee e-commerce platform. Threat actors leveraged the Blogspot subdomain space to host a convincing counterfeit storefront aimed at harvesting user credentials and payment details under the guise of a promotional campaign or limited-time offer. The site’s visual mimicry of Shopee’s branding and checkout flow increases the likelihood of successful deception, particularly among less attentive or mobile-first users.

This domain was flagged by 6 of 95 VirusTotal security vendors and resolves to Google IP 142.251.36.97 using a Google Trust Services SSL certificate. It operates within the Blogspot (blogger.com) ecosystem, a legitimate platform frequently exploited for quick deployment of phishing lures. The certificate chain and IP mapping align with Google infrastructure, adding a veneer of authenticity that can mislead users and even some automated detectors. While the domain itself lacks direct inclusion on major blocklists in current feeds, its low detection ratio and active content indicate a recently activated campaign targeting Southeast Asian e-commerce users, especially in markets where Shopee is a dominant player.

To mitigate exposure to replica storefront phishing, users should verify the URL spelling and use HTTPS indicators; avoid clicking on unsolicited links in messages or social media ads. Enterprises can deploy browser-based phishing detection rules targeting Blogspot subdomains combined with real-time domain reputation checks. Security teams should block the IP 142.251.36.97 and inspect outbound traffic to *.blogspot.com for anomalous POST requests or credential submission to unknown domains. Report suspicious URLs immediately to your IT security team or via PhishDestroy’s public portal to accelerate takedown cycles.