program-resmi1212[.]blogspot[.]com

This domain is identified as a phishing resource designed to impersonate the Shopee e-commerce platform, specifically targeting users during the checkout process. Analysis of the page title and visual elements confirms the intent to deceive victims into entering sensitive payment details, including credit card numbers, CVV codes, and login credentials. The fraudulent nature of this campaign is further supported by its focus on transactional workflows, a common tactic used to harvest financial data for subsequent unauthorized transactions or identity theft. Infrastructure analysis reveals the domain program-resmi1212.blogspot.com was registered through Google Blogger on April 9, 2026, and resolves to the IP address 142.251.127.132, hosted by a major cloud provider in the United States. The SSL certificate, issued by Google Trust Services (WE2), provides a false sense of security while the domain appears on one security blocklist. Detection metrics indicate a moderate but concerning level of recognition, with 18 out of 95 security engines on a prominent threat intelligence platform flagging the domain as malicious. The domain has since been taken offline, though its temporary availability posed a significant risk to unsuspecting users. Users who accessed program-resmi1212.blogspot.com or entered credentials on any page resembling Shopee checkout should immediately revoke active sessions and change passwords for their Shopee accounts. Financial institutions should be notified if payment details were submitted, and credit monitoring services should be considered to detect potential fraudulent activity. System scans using updated security tools are recommended to identify any residual threats. Organizations should update their web filtering rules to block this domain and monitor for similar patterns, such as subdomains under blogspot.com impersonating legitimate brands.