info-resmi471[.]blogspot[.]com

This domain, info-resmi471.blogspot.com, was observed conducting credential theft operations targeting users of the Shopee e-commerce platform. The site presented a fraudulent login interface designed to harvest account credentials, including usernames, passwords, and potentially payment details. Such attacks pose significant risks, including unauthorized account access, financial fraud, and identity theft for victims who interact with the page. Analysis indicates the domain was registered through Google Blogger, a legitimate platform frequently exploited for phishing due to its accessibility and SSL certification. The site resolved to the IPv6 address 2a00:1450:4001:c1f::84, associated with Google’s infrastructure, and utilized technologies including Java, Python, and OpenGSE. Detection metrics reveal the domain was flagged by 9 out of 95 security vendors on VirusTotal, with one additional security blocklist listing. The SSL certificate, issued by Google Trust Services, further obscured its malicious intent by presenting a seemingly legitimate encrypted connection. Users who visited info-resmi471.blogspot.com or entered credentials on the site should immediately take corrective action. First, change passwords for Shopee and any other accounts where identical credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions. If payment details were entered, contact the relevant financial institution to report potential exposure and request card replacement. Finally, scan local devices for malware using updated security tools to ensure no secondary infections occurred.