shopeeid524[.]blogspot[.]com

This domain, shopeeid524.blogspot.com, is identified as a phishing infrastructure impersonating the Shopee e-commerce platform. Analysis indicates the threat type is a fake login portal designed to harvest user credentials under the guise of the legitimate Shopee brand. The page title explicitly displays 'SHOPEE,' reinforcing the impersonation attempt. No cryptocurrency drainer kit signatures or wallet addresses were observed in the available data, suggesting a focus on credential theft rather than financial asset compromise. Infrastructure analysis reveals the domain was registered through Google Blogger on May 06, 2026, an anomalous creation date likely indicative of data entry error or deliberate obfuscation. The domain resolves to the IP address 192.178.183.132, hosted under Google LLC in the United States. The SSL certificate is issued by Google Trust Services (WE2), providing a veneer of legitimacy. VirusTotal detection metrics show 20 out of 95 security vendors flagging the domain as malicious. The domain appears on a single security blocklist and was proactively blocked by at least one threat intelligence feed. No Google Safe Browsing (GSB) classification was provided in the available data. As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, residual threats persist due to potential credential reuse by victims or delayed reporting of stolen data. The infrastructure leveraged free hosting services and automated certificate issuance, demonstrating low-cost, scalable phishing tactics. Users who interacted with the domain are advised to reset credentials for Shopee and any accounts sharing the same login details. Organizations should monitor for credential-stuffing attempts originating from harvested data and update blocklists to include the domain and associated IP address.