# PhishDestroy domain threat record: berkah-ramadhan57.blogspot.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/berkah-ramadhan57.blogspot.com/
Machine-readable companion: https://phishdestroy.io/domain/berkah-ramadhan57.blogspot.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-05 14:58:58 UTC
- Last availability or vendor check: 2026-10-22 10:06:05 UTC
- Stored record updated: 2026-10-22 15:44:51 UTC
- VirusTotal detections in the stored snapshot: 9/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ShopeePay

## Stored infrastructure

- Observed IP address: 142.251.127.132
- Registrar in stored WHOIS data: Google LLC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 404
- Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a07213-1f0b-72e0-9a32-7e09bdb61cba/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/berkah-ramadhan57.blogspot.com
- Certificate Transparency search: https://crt.sh/?q=%25.berkah-ramadhan57.blogspot.com
- Web Archive lookup: https://web.archive.org/web/*/https://berkah-ramadhan57.blogspot.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
berkah-ramadhan57.blogspot.com is a Blogspot page titled "SHOPEE INDONESIA" that poses as the Indonesian e-commerce marketplace. Its name means "Ramadan blessings" in Indonesian, a theme that suits fake holiday promotions aimed at Shopee buyers. PhishDestroy first flagged it on 2026-09-05. On 2026-10-19 the address still resolved, but its root page served no content.

How the scam works
Shopee impersonation pages usually promise a seasonal reward, such as a Ramadan voucher, cashback or prize draw, and then ask the visitor to claim it. The claim step typically requests a Shopee login, phone number, one-time codes, or e-wallet and bank details. With those, operators can take over the shopping account, spend linked balances or run further fraud in the victim's name. Free blog hosting lets such pages be spun up and replaced quickly under fresh themed names.

Evidence
Nine of 89 VirusTotal engines flagged the page in a check on 2026-09-11. The vendors include alphaMountain.ai, BitDefender, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft and Netcraft. Several of those are mainstream antivirus and anti-phishing feeds, so the verdict does not rest on a single source. urlscan.io independently rated the page malicious and detected the Shopee brand on it, which matches our impersonation classification. The domain is listed on the PhishDestroy blocklist.

Infrastructure
The page sits on a subdomain of Google's Blogspot service. The 2000-07-31 registration date and the Google LLC registrar belong to blogspot.com itself, so they say nothing about when this particular page was created. Hosting resolves to Google's US network, and the certificate from Google Trust Services is issued automatically to every Blogspot site. A padlock here is therefore no sign of legitimacy.

What to do
If you entered Shopee credentials on this page, change your Shopee password and turn on two-factor authentication. Change the same password anywhere else you reused it, and sign out of other sessions. If you shared an OTP, card, ShopeePay or bank details, contact Shopee and your bank right away to freeze payments and dispute unauthorized charges. Treat any follow-up messages about the "Ramadan reward" as part of the scam. Defenders should block the subdomain, watch for sibling Blogspot pages with similar Shopee or Ramadan naming, and report it to Google's Blogger abuse channel for removal.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a07213-1f0b-72e0-9a32-7e09bdb61cba/
VirusTotal report: https://www.virustotal.com/gui/domain/berkah-ramadhan57.blogspot.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=berkah-ramadhan57.blogspot.com
Archived copy: https://web.archive.org/web/20260905151543/https://berkah-ramadhan57.blogspot.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:49:18 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/cK89n88R/e84184ddab3a.png
  Captured: 2026-09-05 14:58:58 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a07213-1f0b-72e0-9a32-7e09bdb61cba.png
  Captured: 2026-09-05 14:58:58 UTC
  Source report: https://urlscan.io/result/01a07213-1f0b-72e0-9a32-7e09bdb61cba/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/145a8625-250f-4d1f-886a-5b529bd44723.png
  Captured: 2026-09-05 15:40:12 UTC
  Source report: https://radar.cloudflare.com/scan/145a8625-250f-4d1f-886a-5b529bd44723
  SHA-256: 90d240959463e73dd49ca0d99fd99174d7e56391abc93a051325419a16c65f33
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06ba5-bd14-74cf-9f90-11fcd5f86ce3.png
  Captured: 2026-09-04 09:00:27 UTC
  Source report: https://urlscan.io/result/01a06ba5-bd14-74cf-9f90-11fcd5f86ce3/
  SHA-256: 524820ffb033d6cd9b37b9fd20c1877d9f91efcac59f33b7819215fc16198ee2
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06be4-2a8c-75df-8255-50a05b8eef18.png
  Captured: 2026-09-04 10:08:39 UTC
  Source report: https://urlscan.io/result/01a06be4-2a8c-75df-8255-50a05b8eef18/
  SHA-256: 95d0527ebcdac23f28050bd36201190bc527f389918a524fcd7bbaddf80292c5
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06c32-7ed3-768c-a656-599b087339a0.png
  Captured: 2026-09-04 11:34:13 UTC
  Source report: https://urlscan.io/result/01a06c32-7ed3-768c-a656-599b087339a0/
  SHA-256: ad67e51bc987b90fea2c02f05f0b83a80e3438df52ed4c64beee1a12bee3cc74
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06c54-d6ea-7007-b0bf-725a845d9ea3.png
  Captured: 2026-09-04 12:11:44 UTC
  Source report: https://urlscan.io/result/01a06c54-d6ea-7007-b0bf-725a845d9ea3/
  SHA-256: 43c6a6bf1bebd0fb470e2fe4e8fd52f40a72dddf252141fe6321bc0e66f05541
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06c74-9747-763d-8dc4-68c65b1bf07b.png
  Captured: 2026-09-04 12:46:22 UTC
  Source report: https://urlscan.io/result/01a06c74-9747-763d-8dc4-68c65b1bf07b/
  SHA-256: a2d050bcfa1d5a3f6eb6b6a6341c4f46f08253e564be14e7a2d5310d18db86c2
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12db6-c6a1-707f-81c1-08b902c989fa.png
  Captured: 2026-10-12 01:25:22 UTC
  Source report: https://urlscan.io/result/01a12db6-c6a1-707f-81c1-08b902c989fa/
  SHA-256: 448a78b488436ab1016bb9f6f96c468dbed744237250bf8078d8aa07c26d7218

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T03:49:28Z",
        "uuid": "01a07213-1f0b-72e0-9a32-7e09bdb61cba",
        "scanned_at": "2026-09-05T14:57:40Z",
        "final_url": "https://berkah-ramadhan57.blogspot.com/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://berkah-ramadhan57.blogspot.com/",
                "from": "http://berkah-ramadhan57.blogspot.com/",
                "status": 307
            },
            {
                "to": "https://berkah-ramadhan57.blogspot.com/",
                "from": "https://berkah-ramadhan57.blogspot.com/",
                "status": 302
            }
        ],
        "ip": "142.251.13.132",
        "ptr": "wt-in-f132.1e100.net",
        "domains": [
            "blogger.googleusercontent.com",
            "www.blogger.com",
            "apis.google.com",
            "resources.blogblog.com",
            "pagead2.googlesyndication.com",
            "4.bp.blogspot.com"
        ],
        "ips": [
            "142.251.20.156",
            "142.251.20.132",
            "142.251.110.132",
            "142.251.14.100",
            "142.251.110.191",
            "142.251.13.132"
        ],
        "asns": [
            "15169"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "blogger.googleusercontent.com",
            "www.blogger.com",
            "support.google.com",
            "www.google.com"
        ],
        "doc_hash": "a81dffbe2125138c811bd710e588e6bd780cc00ac35d1cf29a746a8e87143b85",
        "script_hashes": [
            "068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568"
        ],
        "globals": [
            "adsbygoogle",
            "setAttributeOnload",
            "gapi",
            "___jsl",
            "Login",
            "BLOG_attachCsiOnload",
            "_WidgetManager",
            "_WidgetInfo",
            "widget_module_provide",
            "_AdSenseView",
            "_BlogArchiveView",
            "_AttributionView",
            "_BlogView",
            "_BlogListView",
            "_BlogSearchView",
            "_ContactFormView",
            "_ExampleView",
            "_FeaturedPostView",
            "_FeedView",
            "_FollowersView",
            "_HeaderView",
            "_TextView",
            "_HTMLView",
            "_ImageView",
            "_LabelView",
            "_TextListView",
            "_LinkListView",
            "_BloggerButtonView",
            "_NavbarView",
            "_PageListView",
            "_PollView",
            "_PopularPostsView",
            "_ProfileView",
            "_RecentPostsView",
            "_ReportAbuseView",
            "_SharingView",
            "_StatsView",
            "_SubscribeView",
            "_SW_toggleReaderList",
            "_SW_hideReaderList"
        ],
        "tls": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE2",
            "subject": "misc-sni.blogspot.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-02T08:38:52Z",
            "valid_from": "2026-08-10T08:38:53Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 26,
        "tls_valid_days": 83,
        "requests": 28,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "shopee"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Shopee"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GSE",
            "content-type": "text/html; charset=UTF-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T04:00:13Z",
        "uuid": "145a8625-250f-4d1f-886a-5b529bd44723",
        "scanned_at": "2026-09-05T15:40:12Z",
        "final_url": "https://berkah-ramadhan57.blogspot.com/",
        "status": 200,
        "history": [
            {
                "url": "https://berkah-ramadhan57.blogspot.com/",
                "status": 200
            }
        ],
        "dom_hash": "8946817a381382e9d9c11e4b124685be052ef2513c0fee2d860cfd0b84507c9d",
        "doc_hash": "1489f04195c000bf642d3a6442a812c7ffd1b249f9e89d24ec346be1908142ae",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "4.bp.blogspot.com",
                "type": "CNAME",
                "value": "photos-ugc.l.googleusercontent.com"
            },
            {
                "name": "4.bp.blogspot.com",
                "type": "CNAME",
                "value": "photos-ugc.l.googleusercontent.com"
            },
            {
                "name": "berkah-ramadhan57.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            },
            {
                "name": "berkah-ramadhan57.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.217.171.97",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2000-07-31T21:38:58Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T21:38:58Z",
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ]
        }
    }
}
```