thrshopee227[.]blogspot[.]com

This domain, thrshopee227.blogspot.com, operates as a brand impersonation phishing site targeting Google users under the guise of a "Hadiah THR Shopee 2020" promotion. Analysis indicates the site was designed to deceive visitors into believing it is affiliated with Google, likely to harvest login credentials, personal information, or financial details. The page title explicitly references a fake reward scheme, a common tactic to exploit user trust in well-known brands and create a sense of urgency or legitimacy around fraudulent offers.

Technical evidence confirms the malicious nature of this domain. The site is flagged by 18 out of 95 security vendors on VirusTotal, indicating broad consensus among detection engines. It appears on one security blocklist and is currently offline, though its infrastructure remains a concern. The domain was registered through Google Blogger, leveraging a legitimate platform to host malicious content. It resolves to the IP address 142.250.154.132, which is associated with Google’s infrastructure, further complicating detection efforts. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, suggesting a mix of legitimate and potentially obfuscated components.

Users who visited thrshopee227.blogspot.com should take immediate action to mitigate potential risks. If credentials or personal information were entered, reset passwords for all associated accounts, particularly Google services, using a unique and complex password for each. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Monitor financial statements and account activity for unauthorized transactions or suspicious logins. If the site was accessed on a corporate or shared device, notify the relevant security team to conduct a forensic review and prevent further exposure. Given the domain’s use of Google Trust Services for its SSL certificate, users should also verify the legitimacy of any future sites claiming affiliation with Google by checking for official domain names and HTTPS indicators.