info-resmi212[.]blogspot[.]com

PhishDestroy has identified info-resmi212.blogspot.com as a domain engaged in brand impersonation targeting Shopee customers. This domain is currently offline, but during its active period it posed a significant threat to users by attempting to harvest login credentials and personal information under the guise of the legitimate e-commerce platform. The specific threat type is credential theft, as the site mimicked the Shopee login interface to deceive visitors.

The domain was registered through Google Blogger and resolved to IP address 142.251.20.132, with an SSL certificate issued by Google Trust Services (WE2). According to VirusTotal, 5 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. Despite these indicators, the domain's registration and hosting infrastructure are typically associated with low-cost or free services, making it a common vector for phishing campaigns. The page title retrieved was "SHOPEE," which directly indicates the impersonated brand, and no other trust scores or creation dates were available in the intelligence data.

As of the latest analysis, the domain has been taken offline, which reduces immediate risk. However, users who may have interacted with the site while it was active are advised to change their Shopee passwords and enable two-factor authentication. PhishDestroy recommends that organizations block this domain at the network level and educate users about verifying URLs before entering credentials. Continued monitoring for similar domains is advised, as threat actors often register new domains after takedowns.