shopee2444[.]blogspot[.]com

This domain, shopee2444.blogspot.com, is identified as a generic phishing site targeting users of the e-commerce platform Shopee. Analysis indicates the page mimics legitimate Shopee login interfaces, likely designed to harvest user credentials and payment details. The domain leverages a free subdomain service (Blogger) to evade detection and reduce operational costs, a common tactic in low-sophistication phishing campaigns. No specific drainer kit signatures were observed in initial scans, but the page title 'shopee' confirms brand impersonation intent. Infrastructure analysis reveals the domain was registered through Google Blogger on April 30, 2026, an anomalous future date suggesting possible manipulation of WHOIS records or a placeholder entry. It resolves to the IP address 142.251.14.132, geolocated to the United States and associated with Google LLC infrastructure. The SSL certificate, issued by Google Trust Services (WE2), provides a false sense of security to victims. VirusTotal detection metrics show 19 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and was actively blocked by PhishDestroy. The domain's creation date discrepancy and reliance on Google-hosted services align with patterns observed in disposable phishing infrastructure. As of the latest verification, shopee2444.blogspot.com has been taken offline, likely following abuse reports or automated takedown mechanisms. However, the elevated risk persists due to the potential for rapid re-deployment under a new subdomain or domain. Users who interacted with the site are advised to immediately reset credentials for Shopee and any other platforms where identical passwords may have been reused. Organizations should monitor for similar Blogger-hosted phishing domains using the same SSL certificate issuer (Google Trust Services / WE2) and IP range (142.251.14.0/24). The anomalous creation date (2026) may serve as an additional indicator for future threat hunting.