inforesmi1247[.]blogspot[.]com

This domain, inforesmi1247.blogspot.com, was identified as a credential theft operation targeting users of the e-commerce platform Shopee. Analysis of the page title and infrastructure reveals an attempt to mimic legitimate Shopee login portals, likely to harvest user credentials through fraudulent input forms. The campaign appears designed to exploit trust in the Shopee brand, redirecting victims to a cloned interface hosted on Blogger’s platform. Infrastructure analysis confirms the domain was registered through Google Blogger and resolved to the IP address 142.251.13.132, associated with Google’s hosting services. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy. Detection metrics show 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared on one security blocklist. Technologies detected include Blogger, Java, Python, OpenGSE, and HTTP/3, suggesting automated deployment of the phishing kit. The domain has since been taken offline, though residual risk remains for users who interacted with it. Users who visited inforesmi1247.blogspot.com should immediately revoke any credentials entered on the site, particularly Shopee account logins. Monitor associated accounts for unauthorized activity, including order history and payment methods. Enable multi-factor authentication (MFA) on all critical accounts to mitigate further risk. If financial data was submitted, contact the relevant institution to flag potential fraud. Security teams should update blocklists to include this domain and investigate any internal traffic logs for connections to 142.251.13.132 during the period of activity.