# PhishDestroy domain threat record: hadiah-resmi1577.blogspot.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/hadiah-resmi1577.blogspot.com/ Machine-readable companion: https://phishdestroy.io/domain/hadiah-resmi1577.blogspot.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-31 07:54:59 UTC - Last availability or vendor check: 2026-10-22 10:11:00 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 16/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: shopee ## Stored infrastructure - Observed IP address: 142.251.13.132 - Registrar in stored WHOIS data: Google LLC - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a056cf-25ac-75fa-960c-3b990efb5ce1/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/hadiah-resmi1577.blogspot.com - Certificate Transparency search: https://crt.sh/?q=%25.hadiah-resmi1577.blogspot.com - Web Archive lookup: https://web.archive.org/web/*/https://hadiah-resmi1577.blogspot.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview hadiah-resmi1577.blogspot.com is an impersonation phishing page posing as Shopee. Its page title reads simply "Shopee", and the subdomain name means roughly "official prize" in Indonesian, which points to a giveaway lure aimed at Shopee's Southeast Asian shoppers. PhishDestroy first flagged it on 2026-08-31. The page was still online and serving content on 2026-10-19. How the scam works Fake Shopee prize pages tell visitors they have won a reward, voucher or lucky draw and must "claim" it. The claim process walks the victim through forms that ask for the phone number or email tied to their Shopee account, the password, the one-time code Shopee sends by SMS, and sometimes a ShopeePay PIN or bank card details. With those, the operator can take over the account, spend the wallet balance or linked payment methods, and reuse the identity for further fraud. Some versions also demand a small "admin" or "delivery" fee before the prize is released, and the prize never arrives. Evidence On 2026-09-12, 16 of 89 VirusTotal engines flagged the page, including BitDefender, ESET, Fortinet, Emsisoft, Forcepoint ThreatSeeker, alphaMountain.ai, CyRadar and the Vietnamese anti-scam project Chong Lua Dao. That is a solid minority of engines from unrelated vendors reaching the same conclusion. urlscan.io independently rated the page malicious and recognised the Shopee branding on it. The domain is listed on the PhishDestroy blocklist. Infrastructure The site is a free Blogger blog, so the 2000-07-31 registration date and the Google LLC registrar belong to the parent blogspot.com platform, not to the scammer. Hosting runs on Google's network in the US, and the TLS certificate from Google Trust Services is the platform default. The padlock shows only that the connection is encrypted. It says nothing about whether Shopee is behind the page. Disposable Blogspot subdomains with numbered names like this one cost nothing to create and are easy to replace once one is reported. What to do If you entered details on this page, change your Shopee password at once through the official app, sign out other sessions, and check your linked email and phone number for changes. Contact Shopee support and your bank if you shared a ShopeePay PIN, card number or SMS code, and watch for unfamiliar orders or wallet transfers. Shopee never asks for OTP codes to release a prize, so treat any request like that as fraud. Defenders should block this hostname and report it through Blogger's abuse channel and to Shopee's brand protection team. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a056cf-25ac-75fa-960c-3b990efb5ce1/ VirusTotal report: https://www.virustotal.com/gui/domain/hadiah-resmi1577.blogspot.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=hadiah-resmi1577.blogspot.com Archived copy: https://web.archive.org/web/20260831075744/https://hadiah-resmi1577.blogspot.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:53:44 UTC ## Stored page captures - Primary capture: https://i.ibb.co/nMhdRcs1/6d2c575b9324.png Captured: 2026-08-31 07:54:59 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a056cf-25ac-75fa-960c-3b990efb5ce1.png Captured: 2026-08-31 07:54:59 UTC Source report: https://urlscan.io/result/01a056cf-25ac-75fa-960c-3b990efb5ce1/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:26:38Z", "uuid": "01a056cf-25ac-75fa-960c-3b990efb5ce1", "scanned_at": "2026-08-31T07:53:44Z", "final_url": "https://hadiah-resmi1577.blogspot.com/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://hadiah-resmi1577.blogspot.com/", "from": "http://hadiah-resmi1577.blogspot.com/", "status": 307 }, { "to": "https://hadiah-resmi1577.blogspot.com/", "from": "https://hadiah-resmi1577.blogspot.com/", "status": 302 } ], "ip": "142.250.195.97", "ptr": "tzsyda-ad-in-f1.1e100.net", "domains": [ "blogger.googleusercontent.com", "www.blogger.com", "resources.blogblog.com", "4.bp.blogspot.com" ], "ips": [ "172.217.25.161", "142.250.195.129", "142.251.222.9", "142.250.195.169", "142.250.195.97" ], "asns": [ "15169" ], "countries": [ "US" ], "link_domains": [ "www.blogger.com", "blogger.googleusercontent.com", "api.whatsapp.com" ], "social": [ "https://api.whatsapp.com/send" ], "doc_hash": "8f9d1a2bb90a9b5969806e3a8096a6fa447e9e818a2a2e825de9a2afb69c6f60", "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "BLOG_attachCsiOnload", "_WidgetManager", "_WidgetInfo", "widget_module_provide", "_AdSenseView", "_BlogArchiveView", "_AttributionView", "_BlogView", "_BlogListView", "_BlogSearchView", "_ContactFormView", "_ExampleView", "_FeaturedPostView", "_FeedView", "_FollowersView", "_HeaderView", "_TextView", "_HTMLView", "_ImageView", "_LabelView", "_TextListView", "_LinkListView", "_BloggerButtonView", "_NavbarView", "_PageListView", "_PollView", "_PopularPostsView", "_ProfileView", "_RecentPostsView", "_ReportAbuseView", "_SharingView", "_StatsView", "_SubscribeView", "_SW_toggleReaderList", "_SW_hideReaderList", "_TranslateView" ], "tls": { "san": [ "misc-sni.blogspot.com", "blogspot.ae", "*.blogspot.ae", "blogspot.al", "*.blogspot.al", "blogspot.am", "*.blogspot.am", "blogspot.ba", "*.blogspot.ba", "blogspot.be" ], "cipher": "AES_128_GCM", "issuer": "WR2", "subject": "misc-sni.blogspot.com", "protocol": "TLS 1.3", "valid_to": "2026-11-02T08:38:44Z", "valid_from": "2026-08-10T08:38:45Z" }, "domain_age_days": 28, "apex_age_days": 28, "tls_age_days": 20, "tls_valid_days": 83, "requests": 62, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "shopee" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Shopee" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "GSE", "content-type": "text/html; charset=UTF-8", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:37:37Z", "uuid": "a50ba537-d8b8-4ee8-a0ab-5d8693e9fdbb", "scanned_at": "2026-08-31T08:32:16Z", "final_url": "https://hadiah-resmi1577.blogspot.com/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://hadiah-resmi1577.blogspot.com/", "status": 307 }, { "url": "https://hadiah-resmi1577.blogspot.com/", "status": 200 } ], "dom_hash": "93f7307316acbd22f13ea06ab5a3e73e5e3e55fbc15f83bc4a49fe20c15e0468", "doc_hash": "53eba6c958a561c1416ed025b25ffa64832060ac8e364d0f078d7a982db19597", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "4.bp.blogspot.com", "type": "CNAME", "value": "photos-ugc.l.googleusercontent.com" }, { "name": "4.bp.blogspot.com", "type": "CNAME", "value": "photos-ugc.l.googleusercontent.com" }, { "name": "hadiah-resmi1577.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" }, { "name": "hadiah-resmi1577.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" } ], "dnssec_valid": false, "ip": "172.217.17.193", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2000-07-31T21:38:58Z", "updated": "2026-06-29T10:34:06Z", "expires": "2027-07-31T21:38:58Z", "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ] } } } ```