shopee-002[.]blogspot[.]com

Analysis of shopee-002.blogspot.com, conducted on August 07, 2026, confirms its classification as an active phishing domain targeting users of the Shopee platform. The domain is flagged by 17 of 91 security vendors on VirusTotal, with specific detections from PhishDestroy and OpenPhish, indicating a coordinated response to its malicious intent. It appears on two independent security blocklists, further corroborating its elevated risk status. Infrastructure analysis reveals the domain resolves to IP address 173.194.222.132, which is associated with Google's blog hosting service, Blogspot.

While the use of a legitimate hosting provider may initially obscure its malicious nature, the detection metrics and blocklist inclusions provide clear evidence of its role in phishing operations. The domain's structure, incorporating 'shopee' within its subdomain, suggests an attempt to deceive users into believing it is affiliated with the legitimate Shopee e-commerce platform. However, no further technical details regarding the specific phishing kit, page content, or brand impersonation tactics are currently available.

Defenders should treat this domain as hostile and implement blocking measures at the network and endpoint levels. Organizations are advised to monitor for connections to 173.194.222.132 and review logs for any interaction with shopee-002.blogspot.com, particularly in environments where Shopee-related activity is unexpected. Given its active status and detection by multiple security vendors, this domain should be prioritized for mitigation in phishing-focused threat intelligence feeds.