# shopee1799.blogspot.com — Recorded security evidence | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/shopee1799.blogspot.com/ Machine-readable companion: https://phishdestroy.io/domain/shopee1799.blogspot.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-26 09:54:00 UTC - Last availability or vendor check: 2026-11-01 03:14:18 UTC - Stored record updated: 2026-11-01 06:18:11 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): ShopeePay ## Stored infrastructure - Observed IP address: 142.251.20.132 - Registrar in stored WHOIS data: Google LLC - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a03d7b-d0f2-71fa-8f6b-9b65b64a5226/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/shopee1799.blogspot.com - Certificate Transparency search: https://crt.sh/?q=%25.shopee1799.blogspot.com - Web Archive lookup: https://web.archive.org/web/*/https://shopee1799.blogspot.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy stores a record for shopee1799.blogspot.com. Source observations are dated separately; missing checks do not establish safety. PhishDestroy stores a record for shopee1799.blogspot.com. Source observations are dated separately; missing checks do not establish safety. A reviewed analysis is not available for this text revision. Consult the dated source records below. Package revision: 14af5e4db93f2eb11da7241c26c90725b77903953d393aedb9c3125120311eaf Source facts (timestamps as stored): {"record_id":640937,"first_recorded_at":"2026-08-26 11:54:00","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":16,"denominator":92,"malicious":15,"suspicious":1,"vendors":{"ESET":"suspicious","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Emsisoft":"phishing","Fortinet":"phishing","Netcraft":"malicious","Kaspersky":"phishing","LevelBlue":"phishing","Gridinsoft":"phishing","MalwareURL":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing"},"observed_at":"2026-10-09T13:18:39Z","checked_at":"2026-09-30 04:08:02","fetched_at":"2026-10-23T15:03:57Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":null,"numerator":14,"denominator":91,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","ESET","Emsisoft","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Kaspersky","Lionic","MalwareURL","Netcraft","Sophos","Webroot"],"observed_at":null,"checked_at":"2026-09-30 04:08:02","fetched_at":null,"time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-08-31 02:43:58"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-25 20:30:55"},"availability":{"source":"stored HTTP observation","state":"alive","observed_at":"2026-11-01 04:14:18"}} ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a03d7b-d0f2-71fa-8f6b-9b65b64a5226.png Captured: 2026-08-26 09:54:00 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a03d7b-d0f2-71fa-8f6b-9b65b64a5226.png Captured: 2026-08-26 09:54:00 UTC Source report: https://urlscan.io/result/01a03d7b-d0f2-71fa-8f6b-9b65b64a5226/ - URLScan · 2026-08-24: https://screenshots.phishdestroy.io/us/01a033dc-95ea-7087-a96f-d444d66fe238.png Captured: 2026-08-24 13:01:38 UTC Source report: https://urlscan.io/result/01a033dc-95ea-7087-a96f-d444d66fe238/ SHA-256: 1fde331a179addb0acbc7a04c27997053b0d266fcb0453c38f9216bcfdc361b9 - URLScan · 2026-08-24: https://screenshots.phishdestroy.io/us/01a034ab-4c17-71cd-a684-4c9769a71e16.png Captured: 2026-08-24 16:47:25 UTC Source report: https://urlscan.io/result/01a034ab-4c17-71cd-a684-4c9769a71e16/ SHA-256: 22f0524e30e01df385e32f78d2c58f8a909452c12482d6cc55b07df19d25aa32 - URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a03660-10dc-729a-a286-8b8f65c3520d.png Captured: 2026-08-25 00:44:28 UTC Source report: https://urlscan.io/result/01a03660-10dc-729a-a286-8b8f65c3520d/ SHA-256: 6f208f3068258af1b900828144946f67fd18575489e6e185d1f2e13e1fb45f84 - URLScan · 2026-08-26: https://screenshots.phishdestroy.io/us/01a03edb-203f-76ad-9fa4-ded7affce05b.png Captured: 2026-08-26 16:15:57 UTC Source report: https://urlscan.io/result/01a03edb-203f-76ad-9fa4-ded7affce05b/ SHA-256: 8a55e2d8d752148db983cdaa47dfb3772f51cad633eba60ff1f0f742d6642215 - URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06d97-fd2b-76d8-ac3b-aa1a9c3fd7b5.png Captured: 2026-09-04 18:04:40 UTC Source report: https://urlscan.io/result/01a06d97-fd2b-76d8-ac3b-aa1a9c3fd7b5/ SHA-256: 8f2f37f16e0fda1950fcfa178cdf7a140d7f00ef2b43a9d243b87c27daf3f91a - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0edaf-837f-724a-af22-7640165f3293.png Captured: 2026-09-29 15:01:46 UTC Source report: https://urlscan.io/result/01a0edaf-837f-724a-af22-7640165f3293/ SHA-256: 5e13f34aa892c46e723d8baa78a3fb4f75a67df1ac98979c7cc2030dbd7280b7 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b333a1fe-b870-45f4-8c5b-213156be1a8f.png Captured: 2026-08-26 10:01:20 UTC Source report: https://radar.cloudflare.com/scan/b333a1fe-b870-45f4-8c5b-213156be1a8f SHA-256: a0e7c64329e6e075ee9a3543f787b2826ff2900f7adbb12d6198a1d8f5061e9e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:31:22Z", "uuid": "01a03d7b-d0f2-71fa-8f6b-9b65b64a5226", "scanned_at": "2026-08-26T09:52:08Z", "final_url": "https://shopee1799.blogspot.com/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://shopee1799.blogspot.com/", "from": "http://shopee1799.blogspot.com/", "status": 307 }, { "to": "https://shopee1799.blogspot.com/", "from": "https://shopee1799.blogspot.com/", "status": 302 } ], "ip": "142.251.110.132", "ptr": "bz-in-f132.1e100.net", "domains": [ "blogger.googleusercontent.com", "www.youtube.com", "www.blogger.com", "jnn-pa.googleapis.com", "googleads.g.doubleclick.net", "i.ytimg.com", "www.google.com", "static.doubleclick.net", "fonts.gstatic.com", "www.gstatic.com", "yt3.ggpht.com", "encrypted-tbn3.gstatic.com", "4.bp.blogspot.com" ], "ips": [ "172.217.118.4", "192.178.183.132", "142.251.14.119", "142.251.153.119", "192.178.183.148", "142.251.110.155", "142.251.20.94", "142.251.14.100", "142.251.152.4", "142.251.14.132", "142.251.110.191", "142.251.110.132" ], "asns": [ "15169" ], "countries": [ "US" ], "link_domains": [ "blogger.googleusercontent.com", "www.blogger.com" ], "doc_hash": "9a93ea249b42b2dd69cc12ca40d3c90639b6910d0bb045ac8b0e9d736a8b40fb", "script_hashes": [ "068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568" ], "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "adsbygoogle", "BLOG_attachCsiOnload", "_WidgetManager", "_WidgetInfo", "widget_module_provide", "_AdSenseView", "_BlogArchiveView", "_AttributionView", "_BlogView", "_BlogListView", "_BlogSearchView", "_ContactFormView", "_ExampleView", "_FeaturedPostView", "_FeedView", "_FollowersView", "_HeaderView", "_TextView", "_HTMLView", "_ImageView", "_LabelView", "_TextListView", "_LinkListView", "_BloggerButtonView", "_NavbarView", "_PageListView", "_PollView", "_PopularPostsView", "_ProfileView", "_RecentPostsView", "_ReportAbuseView", "_SharingView", "_StatsView", "_SubscribeView", "_SW_toggleReaderList", "_SW_hideReaderList" ], "cookies": [ "__Secure-YNID", "YSC", "__Secure-ROLLOUT_TOKEN", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA" ], "tls": { "san": [ "misc-sni.blogspot.com", "blogspot.ae", "*.blogspot.ae", "blogspot.al", "*.blogspot.al", "blogspot.am", "*.blogspot.am", "blogspot.ba", "*.blogspot.ba", "blogspot.be" ], "cipher": "AES_128_GCM", "issuer": "WE2", "subject": "misc-sni.blogspot.com", "protocol": "TLS 1.3", "valid_to": "2026-11-02T08:38:52Z", "valid_from": "2026-08-10T08:38:53Z" }, "domain_age_days": 152, "apex_age_days": 152, "tls_age_days": 16, "tls_valid_days": 83, "requests": 83, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "shopee" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Shopee" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "GSE", "content-type": "text/html; charset=UTF-8", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T05:59:10Z", "uuid": "b333a1fe-b870-45f4-8c5b-213156be1a8f", "scanned_at": "2026-08-26T10:01:20Z", "final_url": "https://shopee1799.blogspot.com/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://shopee1799.blogspot.com/", "status": 307 }, { "url": "https://shopee1799.blogspot.com/", "status": 200 } ], "dom_hash": "66c19ef6f67349f00f3d1f7eb23a87f503fae099914c29319aa488bddff20e7b", "doc_hash": "05b814b5595e3d95eadbbc368101780b546367b10c3f24ec9d15016293e39096", "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "4.bp.blogspot.com", "type": "CNAME", "value": "photos-ugc.l.googleusercontent.com" }, { "name": "4.bp.blogspot.com", "type": "CNAME", "value": "photos-ugc.l.googleusercontent.com" }, { "name": "shopee1799.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" }, { "name": "shopee1799.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" } ], "dnssec_valid": false, "ip": "192.178.24.129", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2000-07-31T21:38:58Z", "updated": "2026-06-29T10:34:06Z", "expires": "2027-07-31T21:38:58Z", "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T15:03:57Z", "analysis_at": "2026-10-09T13:18:39Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 15, "suspicious": 1, "undetected": 31 }, "detections": { "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "Kaspersky": "phishing", "LevelBlue": "phishing", "Gridinsoft": "phishing", "MalwareURL": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "MarkMonitor Inc.", "created": "2000-07-31T21:38:58Z", "expires": "2027-07-31T21:38:58Z", "updated": "2026-06-29T10:34:06Z", "first_seen": "2026-03-26T03:13:08Z", "dns": [ { "ttl": 300, "type": "CNAME", "value": "blogspot.l.googleusercontent.com" }, { "ttl": 300, "type": "AAAA", "value": "2607:f8b0:4001:c62::84" }, { "ttl": 300, "type": "A", "value": "173.194.206.132" } ], "dns_at": "2026-10-09T13:19:39Z", "jarm": "27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36c", "cert": { "san": [ "misc-sni.blogspot.com", "blogspot.ae", "*.blogspot.ae", "blogspot.al", "*.blogspot.al", "blogspot.am", "*.blogspot.am", "blogspot.ba", "*.blogspot.ba", "blogspot.be" ], "issuer": "Google Trust Services / WR2", "serial": "314459051a6865d30a64aaa66545849a", "sha256": "4857922e4732af9da27dfbbe57b2c741da8a8af83def47e9345092cbed8e2508", "subject": "misc-sni.blogspot.com", "valid_to": "2026-12-11T20:01:21Z", "valid_from": "2026-09-18T20:01:22Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2000-07-31T07:00:00Z", "updated": "2026-06-29T10:34:06Z", "expires": "2027-07-31T00:00:00Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "serverDeleteProhibited", "serverTransferProhibited", "serverUpdateProhibited" ], "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ], "dnssec": "unsigned" } } } ```