ptshopeeid722[.]blogspot[.]com

This domain, ptshopeeid722.blogspot.com, is identified as a high-risk credential theft operation impersonating the Shopee e-commerce platform. Analysis of the page title, HADIAH SHOPEE 2020, indicates an attempt to deceive users by falsely offering rewards or prizes under the pretext of a 2020 promotional event. The domain is designed to harvest login credentials, payment details, or personal information from victims who believe they are interacting with a legitimate Shopee campaign. No evidence of a crypto drainer kit or blockchain-related payloads was observed in initial triage, though credential theft remains the primary objective. Technical indicators confirm the domain's malicious nature. VirusTotal detection rates show 17 out of 95 security vendors flagging the domain as malicious. Infrastructure analysis reveals the domain is hosted on Google Blogger, resolving to the IP address 142.251.110.132, located in Germany under Google LLC’s autonomous system (AS15169). The SSL certificate is issued by Google Trust Services, a common characteristic of both legitimate and malicious domains leveraging Google’s infrastructure. The domain appears on one security blocklist, and Google Safe Browsing (GSB) has not yet classified it as unsafe at the time of this report. Registration details are obscured by the use of Blogger’s platform, limiting visibility into the threat actor’s identity or origin. The domain remains active and continues to pose a significant risk to users. While PhishDestroy has blocked access, the infrastructure remains operational, and the threat actor may migrate the phishing content to alternative domains or subdomains. Users who interacted with the domain are advised to reset credentials for Shopee and any other accounts where identical passwords were reused. Organizations should update blocklists to include this domain and monitor for related indicators of compromise, such as the IP address 142.251.110.132 or the SSL certificate issuer. Continuous monitoring of Google Blogger-hosted domains with similar naming conventions (e.g., shopee[randomstring]) is recommended to detect follow-up campaigns.