shopee8854[.]blogspot[.]com

Analysis of shopee8854.blogspot.com on July 29, 2026 identifies an active phishing domain hosted on Google Blogger infrastructure. Infrastructure checks reveal the domain resolves to IP 142.251.36.97, an address associated with Google's content delivery network, which aligns with the registrar's hosting platform. No nameserver records were retrieved during the lookup, a common indicator of rapid domain deployment or misconfiguration often seen in phishing campaigns. The domain is blocked by PhishDestroy and appears on one additional security blocklist, confirming its classification as malicious by at least two independent sources.

VirusTotal telemetry shows 15 of 91 security vendors flagging the domain as phishing-related, providing concrete evidence of its threat status. The absence of further detection context—such as specific brand impersonation, phishing kit signatures, or targeted user actions—limits deeper classification, but the available data supports a generic credential-harvesting operation. No HTTP response code, SSL certificate details, or page title were provided in the initial intelligence, so the exact content and lure remain unconfirmed.

Defenders should treat this domain as an elevated-risk credential theft endpoint and block it at the DNS and proxy layers. Network monitoring should include the resolving IP 142.251.36.97 in watchlists, though caution is advised due to its shared hosting context. Further analysis of captured traffic or sinkholed interactions may reveal additional indicators, such as exfiltration domains or associated threat actor infrastructure.