thr-shopee24[.]blogspot[.]com

Analysis of thr-shopee24.blogspot.com indicates that the domain is actively being used for a generic phishing campaign. The domain resolves to the IP address 142.251.127.132, which belongs to Google's infrastructure, and was registered through Google LLC. No authoritative nameserver records were returned in the DNS query, suggesting that the domain relies on the default Blogger hosting configuration. VirusTotal has recorded detections from 18 of 91 security vendors, demonstrating that multiple independent scanning engines have identified malicious characteristics. The domain is currently listed on two reputable phishing blocklists and has been explicitly blocked by PhishDestroy and OpenPhish, confirming its presence on established threat intelligence feeds.

The site’s status is marked as active, meaning it continues to resolve and can be accessed by users. No page title, brand reference, or specific phishing kit information is available from the provided data, leaving the exact content of the webpage unverified. Defenders should prioritize immediate containment by adding thr-shopee24.blogspot.com to URL filtering rules, firewall deny lists, and endpoint web protection policies.

Continuous monitoring of DNS queries for this domain and related subdomains is advised, as the lack of a custom nameserver may obscure future shifts in hosting. Correlating network traffic to the resolved IP (142.251.127.132) with user activity can help identify potential compromised accounts. Given the multiple vendor detections and blocklist presence, the domain should be treated as high‑risk, and any user attempts to access the URL should be blocked and logged for forensic analysis.