shopeeid4888[.]blogspot[.]com

This domain is flagged as a high-risk credential phishing site targeting users of the Shopee e-commerce platform. Analysis indicates the infrastructure is designed to harvest login credentials, payment details, or personal information under the guise of a legitimate service portal, as evidenced by the page title 'PUSAT SHOPEE 2020' and the use of a well-known brand name in the subdomain. Infrastructure analysis reveals the domain is hosted on Google Blogger, resolving to IP address 142.251.14.132 (AS15169, Google LLC, located in Germany). The SSL certificate is issued by Google Trust Services (WE2), a common obfuscation tactic to appear legitimate. VirusTotal reports 12 out of 95 security vendors have flagged this domain as malicious. The domain is currently active and appears on at least one security blocklist. No historical registration data is available due to its hosting on a blogging platform, which limits visibility into creation date or ownership. Mitigation steps for this specific threat type include immediate blocking of the domain and IP at the network perimeter. Organizations should deploy browser-based warnings for users attempting to access the domain and implement multi-factor authentication (MFA) to reduce the impact of credential theft. Security teams should monitor for signs of compromised accounts, particularly those linked to e-commerce platforms, and conduct phishing awareness training emphasizing the risks of subdomain spoofing and brand impersonation. Indicators of compromise (IOCs) such as the domain, IP, and SSL certificate thumbprint should be added to threat intelligence feeds for proactive detection.