shopeetbk823[.]blogspot[.]com

This domain is flagged as a credential harvesting phishing site targeting users of a Southeast Asian e-commerce platform. Analysis indicates the domain was designed to deceive victims into entering login credentials or financial details through a fraudulent interface impersonating a legitimate service. The risk level is classified as elevated due to confirmed malicious activity and detection by multiple security mechanisms. Infrastructure analysis reveals the domain was registered through Google Blogger on March 26, 2026, and resolves to the IP address 142.251.141.65, hosted under Google LLC in the United States. The SSL certificate is issued by Google Trust Services (WE2), a common characteristic of phishing sites leveraging legitimate infrastructure. The domain appears on one security blocklist and is flagged by 13 out of 95 security vendors on VirusTotal, with the page title explicitly set to "shopee" to enhance deception. The site has since been taken offline, though residual risk remains for users who may have interacted with it prior to removal. Mitigation steps include blocking the domain and associated IP address (142.251.141.65) at the network perimeter to prevent access. Organizations should deploy endpoint protection rules to detect and block similar phishing domains using the seed identifier "f88f2e" for correlation. Users who may have entered credentials on this site should be instructed to reset passwords immediately and enable multi-factor authentication on all accounts. Security teams are advised to monitor for indicators of compromise, including anomalous login attempts or unauthorized transactions, and review logs for connections to the domain or IP address.