# PhishDestroy domain threat record: undianshopee-mart12.blogspot.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/undianshopee-mart12.blogspot.com/
Machine-readable companion: https://phishdestroy.io/domain/undianshopee-mart12.blogspot.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-05 14:51:17 UTC
- Last availability or vendor check: 2026-10-22 10:06:09 UTC
- Stored record updated: 2026-10-22 15:44:51 UTC
- VirusTotal detections in the stored snapshot: 13/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ShopeePay

## Stored infrastructure

- Observed IP address: 142.250.154.132
- Registrar in stored WHOIS data: Google LLC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 404
- Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0720b-e69e-76cc-8f5c-90f15286d576/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/undianshopee-mart12.blogspot.com
- Certificate Transparency search: https://crt.sh/?q=%25.undianshopee-mart12.blogspot.com
- Web Archive lookup: https://web.archive.org/web/*/https://undianshopee-mart12.blogspot.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This Blogger-hosted page poses as Shopee. Its page title is simply "SHOPEE", and its subdomain opens with "undian", the Indonesian and Malay word for a lottery or prize draw. That points squarely at Shopee customers in Southeast Asia who might believe they have won something. PhishDestroy first flagged it on 2026-09-05. On 2026-10-19 the site was still online, but its root page served no content.

How the scam works
Fake Shopee prize-draw pages tell visitors they have won a reward or cash prize and must "claim" it. The claim process typically asks for Shopee login details, one-time codes, phone numbers or bank and e-wallet information. Victims are often also pushed to pay an "administration" or "tax" fee before the prize can be released. Those fees go straight to the scammers, and any credentials or codes handed over can be used to take control of the victim's Shopee account and linked payment methods.

Evidence
On 2026-09-11, 13 of 89 VirusTotal engines flagged the address, among them alphaMountain.ai, BitDefender, CyRadar, ESET, Emsisoft, Fortinet, G-Data and Gridinsoft. That is a minority of engines, but the spread of independent vendors makes it a meaningful signal. urlscan.io returned a malicious verdict and identified Shopee as the imitated brand, which matches our classification. The address appears on the PhishDestroy blocklist.

Infrastructure
The page sits on a free blogspot.com subdomain, so the 2000-07-31 registration date and the Google LLC registrar belong to Blogger itself and say nothing about when this page was created. Hosting resolves to Google's network in the US, and the Google Trust Services certificate is the one Blogger issues to every blog. The padlock therefore lends the page no legitimacy. Throwaway names like "mart12" on free platforms let operators replace a removed page within minutes.

What to do
If you entered your Shopee password on this page, change it immediately through the official Shopee app and enable two-factor authentication. Change it anywhere else you reused it too. If you shared an OTP, card, bank or e-wallet details, contact your bank or wallet provider to block the card and dispute any transactions. Never pay a fee to receive a prize, because Shopee does not run draws through Blogger pages. Defenders should block the subdomain, watch for similar "undianshopee" Blogger names, and report the page through Blogger's abuse channel.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0720b-e69e-76cc-8f5c-90f15286d576/
VirusTotal report: https://www.virustotal.com/gui/domain/undianshopee-mart12.blogspot.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=undianshopee-mart12.blogspot.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:49:19 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/rGnLpTBf/b71e1164b1e6.png
  Captured: 2026-09-05 14:51:17 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0720b-e69e-76cc-8f5c-90f15286d576.png
  Captured: 2026-09-05 14:51:17 UTC
  Source report: https://urlscan.io/result/01a0720b-e69e-76cc-8f5c-90f15286d576/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4555b97a-0af2-4ac8-9a20-461f423ffbe4.png
  Captured: 2026-09-05 15:30:49 UTC
  Source report: https://radar.cloudflare.com/scan/4555b97a-0af2-4ac8-9a20-461f423ffbe4
  SHA-256: c5bd5037b7e5eb6655b9b2d027cc22233853050474b8f743e95d4fd5fb6e6511
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06ba4-d9bf-73fb-83f2-49536f991dcc.png
  Captured: 2026-09-04 08:59:28 UTC
  Source report: https://urlscan.io/result/01a06ba4-d9bf-73fb-83f2-49536f991dcc/
  SHA-256: 8e283b7d8618fcd4711229e319f3c1a362e1380b9afff3d9f3ebfcaf68a018fb
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06bc8-f4c6-730e-9b67-87f4632f572f.png
  Captured: 2026-09-04 09:38:56 UTC
  Source report: https://urlscan.io/result/01a06bc8-f4c6-730e-9b67-87f4632f572f/
  SHA-256: 6de0682aaa0ec91a237cc74a0b29573247fc3a1fe1f5d5306569413a8ae341c3
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06c0b-8e53-774a-836e-8d0b13e0ef95.png
  Captured: 2026-09-04 10:51:46 UTC
  Source report: https://urlscan.io/result/01a06c0b-8e53-774a-836e-8d0b13e0ef95/
  SHA-256: ab9af7d88860c8379aaf6d5327233ea0d316f195e20edf4d015eb5929a0a1726
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06c61-4269-7511-9736-3a000d3e2954.png
  Captured: 2026-09-04 12:25:16 UTC
  Source report: https://urlscan.io/result/01a06c61-4269-7511-9736-3a000d3e2954/
  SHA-256: 69bfe6a87fc51c95445e8d56c1ae5e5a1099e28994ca0b28d55dc047788ccf3b
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06c8c-f21e-744b-91dd-e57846e62e2d.png
  Captured: 2026-09-04 13:13:04 UTC
  Source report: https://urlscan.io/result/01a06c8c-f21e-744b-91dd-e57846e62e2d/
  SHA-256: f294b3ff381e6de47a7f6ab27dc8961ac4b690a75327adf5071feeebdff371ae
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12db6-f4f1-77ca-aa80-484d1b5c3f0f.png
  Captured: 2026-10-12 01:25:38 UTC
  Source report: https://urlscan.io/result/01a12db6-f4f1-77ca-aa80-484d1b5c3f0f/
  SHA-256: 71acb5735670e8cdd6f1ef251991debb248077c8aabe371f1c4e82a9907a88e1

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T03:49:33Z",
        "uuid": "01a0720b-e69e-76cc-8f5c-90f15286d576",
        "scanned_at": "2026-09-05T14:49:49Z",
        "final_url": "https://undianshopee-mart12.blogspot.com/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://undianshopee-mart12.blogspot.com/",
                "from": "http://undianshopee-mart12.blogspot.com/",
                "status": 307
            },
            {
                "to": "https://undianshopee-mart12.blogspot.com/",
                "from": "https://undianshopee-mart12.blogspot.com/",
                "status": 302
            }
        ],
        "ip": "142.250.195.225",
        "ptr": "pnsyda-af-in-f1.1e100.net",
        "domains": [
            "blogger.googleusercontent.com",
            "www.blogger.com",
            "resources.blogblog.com",
            "apis.google.com",
            "pagead2.googlesyndication.com",
            "1.bp.blogspot.com"
        ],
        "ips": [
            "142.250.195.162",
            "142.250.195.129",
            "142.251.42.105",
            "172.217.25.193",
            "142.250.195.174",
            "142.250.183.41",
            "142.250.195.225"
        ],
        "asns": [
            "15169"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.blogger.com",
            "blogger.googleusercontent.com",
            "api.whatsapp.com",
            "support.google.com",
            "www.google.com"
        ],
        "social": [
            "https://api.whatsapp.com/send"
        ],
        "doc_hash": "43d1369a120f92d5270c7c271f5927eea64d508d4ef8457cde6537dacee027b6",
        "globals": [
            "setAttributeOnload",
            "gapi",
            "___jsl",
            "Login",
            "_F_toggles",
            "osapi",
            "gadgets",
            "shindig",
            "iframer",
            "ToolbarApi",
            "iframes",
            "IframeBase",
            "Iframe",
            "IframeProxy",
            "IframeWindow",
            "google_empty_script_included",
            "BLOG_attachCsiOnload",
            "_WidgetManager",
            "_WidgetInfo",
            "widget_module_provide",
            "_AdSenseView",
            "_BlogArchiveView",
            "_AttributionView",
            "_BlogView",
            "_BlogListView",
            "_BlogSearchView",
            "_ContactFormView",
            "_ExampleView",
            "_FeaturedPostView",
            "_FeedView",
            "_FollowersView",
            "_HeaderView",
            "_TextView",
            "_HTMLView",
            "_ImageView",
            "_LabelView",
            "_TextListView",
            "_LinkListView",
            "_BloggerButtonView",
            "_NavbarView"
        ],
        "tls": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WR2",
            "subject": "misc-sni.blogspot.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-02T08:38:44Z",
            "valid_from": "2026-08-10T08:38:45Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 26,
        "tls_valid_days": 83,
        "requests": 51,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "shopee"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Shopee"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GSE",
            "content-type": "text/html; charset=UTF-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T04:00:17Z",
        "uuid": "4555b97a-0af2-4ac8-9a20-461f423ffbe4",
        "scanned_at": "2026-09-05T15:30:49Z",
        "final_url": "https://undianshopee-mart12.blogspot.com/",
        "status": 200,
        "history": [
            {
                "url": "https://undianshopee-mart12.blogspot.com/",
                "status": 200
            }
        ],
        "dom_hash": "665f72137117e62f737ecd79abf72702613c9b0e5e1359b2b24217f89094ef32",
        "doc_hash": "10252cc697cfb9bd83cbc882b45caafe2cc6c2546102e7d7753ebe69727fde39",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "1.bp.blogspot.com",
                "type": "CNAME",
                "value": "photos-ugc.l.googleusercontent.com"
            },
            {
                "name": "1.bp.blogspot.com",
                "type": "CNAME",
                "value": "photos-ugc.l.googleusercontent.com"
            },
            {
                "name": "undianshopee-mart12.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            },
            {
                "name": "undianshopee-mart12.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "142.251.14.132",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2000-07-31T21:38:58Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T21:38:58Z",
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ]
        }
    }
}
```