# PhishDestroy domain threat record: gebyar-shopee84.blogspot.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gebyar-shopee84.blogspot.com/
Machine-readable companion: https://phishdestroy.io/domain/gebyar-shopee84.blogspot.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-05 01:13:21 UTC
- Last availability or vendor check: 2026-10-22 10:11:20 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 16/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ShopeePay

## Stored infrastructure

- Observed IP address: 142.251.110.132
- Registrar in stored WHOIS data: Google LLC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a06f1e-bd6f-77ec-9ee2-776b474bfd17/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gebyar-shopee84.blogspot.com
- Certificate Transparency search: https://crt.sh/?q=%25.gebyar-shopee84.blogspot.com
- Web Archive lookup: https://web.archive.org/web/*/https://gebyar-shopee84.blogspot.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
gebyar-shopee84.blogspot.com is a phishing page that poses as Shopee, the e-commerce marketplace, under a name built around "gebyar", the Indonesian word for a festive sale or prize event. It targets Shopee users who might believe they have reached an official promotion. PhishDestroy first flagged it on 2026-09-05, and as of 2026-10-19 the site was still online and serving its content.

How the scam works
The page carries the title "SHOPEE.2021" and dresses itself in Shopee branding so that a visitor arriving from a chat message, social post or ad assumes a genuine giveaway or anniversary event. Lures of this kind usually ask the visitor to "claim" a prize by entering a phone number, Shopee login details or a one-time verification code, or to pay a small processing fee before the reward is released. Anything entered goes straight to the operators, who can then take over the Shopee account, spend linked balances or reuse the credentials elsewhere. The 2021 title suggests an older campaign template that is still being served.

Evidence
On 2026-09-18, 16 of 89 VirusTotal engines classified the page as harmful, including alphaMountain.ai, BitDefender, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. That is a solid spread of independent vendors rather than a lone outlier. urlscan.io returned a malicious verdict and specifically identified Shopee as the imitated brand, which matches our classification. Among the blocklists we track, only PhishDestroy lists it, so many filters may still let it through.

Infrastructure
The page is a free Blogger subdomain. The 2000-07-31 registration date and the Google LLC registrar belong to the parent blogspot.com domain, not to this page, so they say nothing about when the scam started. Hosting sits on Google's network in the US, and the Google Trust Services certificate comes automatically with the platform. The padlock in the browser therefore offers no assurance that the page is legitimate.

What to do
If you typed your Shopee password on this page, change it immediately through the official Shopee app, sign out other sessions and turn on two-factor protection. If you shared a one-time code, check your orders, saved addresses and linked payment methods for changes. If you paid any fee to claim a prize, contact your bank or payment provider right away and report the transaction. Defenders should block this specific subdomain rather than all of blogspot.com and report it to Google's Blogger abuse channel so the page can be removed.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a06f1e-bd6f-77ec-9ee2-776b474bfd17/
VirusTotal report: https://www.virustotal.com/gui/domain/gebyar-shopee84.blogspot.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gebyar-shopee84.blogspot.com
Archived copy: https://web.archive.org/web/20260921202344/https://gebyar-shopee84.blogspot.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:49:50 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a06f1e-bd6f-77ec-9ee2-776b474bfd17.png
  Captured: 2026-09-05 01:13:21 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a06f1e-bd6f-77ec-9ee2-776b474bfd17.png
  Captured: 2026-09-05 01:13:21 UTC
  Source report: https://urlscan.io/result/01a06f1e-bd6f-77ec-9ee2-776b474bfd17/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4d440856-32a6-4697-b42f-761c8ad7fd85.png
  Captured: 2026-09-05 01:19:53 UTC
  Source report: https://radar.cloudflare.com/scan/4d440856-32a6-4697-b42f-761c8ad7fd85
  SHA-256: 19eda269b3b38df29e8968a4b7fb9f8738c72f71082ef4c6250d87bf5a1d4682
- URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a0668b-6d3a-7433-9208-e4a4923564af.png
  Captured: 2026-09-03 09:13:36 UTC
  Source report: https://urlscan.io/result/01a0668b-6d3a-7433-9208-e4a4923564af/
  SHA-256: 48d1cbca00058893819fbaabda0867412586677fed0647ce7ba8a49103c82873
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a06f16-8388-708b-922c-4b574b6d6140.png
  Captured: 2026-09-05 01:02:38 UTC
  Source report: https://urlscan.io/result/01a06f16-8388-708b-922c-4b574b6d6140/
  SHA-256: 2297cf3536425073879a5910b0aacbf22ce22b0e6ed5e659fef78579120df83c
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a071a8-f307-7773-b0db-a379deedaa58.png
  Captured: 2026-09-05 13:01:46 UTC
  Source report: https://urlscan.io/result/01a071a8-f307-7773-b0db-a379deedaa58/
  SHA-256: 31191301dffcdcc0b8217249d9d5b9d09559a75f145d5ea105595ee54b2ef3a3
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a073d2-4974-75d9-8381-f4bce570052e.png
  Captured: 2026-09-05 23:06:03 UTC
  Source report: https://urlscan.io/result/01a073d2-4974-75d9-8381-f4bce570052e/
  SHA-256: 69c4ce12f8ca587ef42a3aa7cbfae784fc934e2c586edceec34dd2702cbc3fe4
- URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a08725-8dd8-719f-bf6d-67f7df8af63b.png
  Captured: 2026-09-09 17:09:49 UTC
  Source report: https://urlscan.io/result/01a08725-8dd8-719f-bf6d-67f7df8af63b/
  SHA-256: 9648bf90516cc4709d266c46381e74fe1c09cfca4a4960a19f8ce4c8c9b02380
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15434-1910-76af-87ba-d67e137f0670.png
  Captured: 2026-10-19 12:47:50 UTC
  Source report: https://urlscan.io/result/01a15434-1910-76af-87ba-d67e137f0670/
  SHA-256: 3fa768b9ed63e8d1235f06d24d6ab69d26e53b9b0c240187824a8b5eec986f80

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T03:50:24Z",
        "uuid": "01a06f1e-bd6f-77ec-9ee2-776b474bfd17",
        "scanned_at": "2026-09-05T01:11:29Z",
        "final_url": "https://gebyar-shopee84.blogspot.com/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://gebyar-shopee84.blogspot.com/",
                "from": "http://gebyar-shopee84.blogspot.com/",
                "status": 307
            },
            {
                "to": "https://gebyar-shopee84.blogspot.com/",
                "from": "https://gebyar-shopee84.blogspot.com/",
                "status": 302
            }
        ],
        "ip": "172.217.203.132",
        "ptr": "uf-in-f132.1e100.net",
        "domains": [
            "blogger.googleusercontent.com",
            "www.blogger.com",
            "resources.blogblog.com",
            "3.bp.blogspot.com"
        ],
        "ips": [
            "142.251.16.132",
            "173.194.217.132",
            "142.251.163.191",
            "172.217.203.132"
        ],
        "asns": [
            "15169"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.blogger.com",
            "blogger.googleusercontent.com",
            "api.whatsapp.com"
        ],
        "social": [
            "https://api.whatsapp.com/send"
        ],
        "doc_hash": "a6354665fc7095bf63303114272104fbf25b2d257bfa1d828e723354d01ff848",
        "globals": [
            "Login",
            "BLOG_attachCsiOnload",
            "_WidgetManager",
            "_WidgetInfo",
            "widget_module_provide",
            "_AdSenseView",
            "_BlogArchiveView",
            "_AttributionView",
            "_BlogView",
            "_BlogListView",
            "_BlogSearchView",
            "_ContactFormView",
            "_ExampleView",
            "_FeaturedPostView",
            "_FeedView",
            "_FollowersView",
            "_HeaderView",
            "_TextView",
            "_HTMLView",
            "_ImageView",
            "_LabelView",
            "_TextListView",
            "_LinkListView",
            "_BloggerButtonView",
            "_NavbarView",
            "_PageListView",
            "_PollView",
            "_PopularPostsView",
            "_ProfileView",
            "_RecentPostsView",
            "_ReportAbuseView",
            "_SharingView",
            "_StatsView",
            "_SubscribeView",
            "_SW_toggleReaderList",
            "_SW_hideReaderList",
            "_TranslateView",
            "_WikipediaView",
            "__wavt",
            "__gjsload__"
        ],
        "tls": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE2",
            "subject": "misc-sni.blogspot.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-02T08:38:52Z",
            "valid_from": "2026-08-10T08:38:53Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 25,
        "tls_valid_days": 83,
        "requests": 50,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "shopee"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Shopee"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GSE",
            "content-type": "text/html; charset=UTF-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T04:00:46Z",
        "uuid": "4d440856-32a6-4697-b42f-761c8ad7fd85",
        "scanned_at": "2026-09-05T01:19:53Z",
        "final_url": "https://gebyar-shopee84.blogspot.com/",
        "status": 200,
        "history": [
            {
                "url": "https://gebyar-shopee84.blogspot.com/",
                "status": 200
            }
        ],
        "dom_hash": "fa1bf2eb93669c4308b5b5886015f2f1e1f9ee7df58e9582152f1de66a16a23d",
        "doc_hash": "fb4c060122831d8a5756b7bea825126645d05cdf35265a08f7d1b598c613216b",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "3.bp.blogspot.com",
                "type": "CNAME",
                "value": "photos-ugc.l.googleusercontent.com"
            },
            {
                "name": "3.bp.blogspot.com",
                "type": "CNAME",
                "value": "photos-ugc.l.googleusercontent.com"
            },
            {
                "name": "gebyar-shopee84.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            },
            {
                "name": "gebyar-shopee84.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "142.251.33.193",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2000-07-31T21:38:58Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T21:38:58Z",
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ]
        }
    }
}
```