bigshopee597[.]blogspot[.]com

PhishDestroy identifies bigshopee597.blogspot.com as an active credential theft domain leveraging a counterfeit shopping platform to harvest user login details. The domain impersonates a well-known e-commerce brand, suggesting a targeted campaign aimed at stealing account credentials under false pretenses. No cryptocurrency drainer kit or advanced obfuscation techniques were observed in available telemetry, but the threat actor’s reliance on brand deception remains a critical red flag.

Technical indicators reveal a 12/95 detection ratio on VirusTotal, alongside resolution to IP 142.251.141.65. The domain operates on Google’s Blogger platform (via blogspot.com) and benefits from a Google Trust Services SSL certificate, which may lull victims into a false sense of security. While the exact creation date is not publicly disclosed, the domain’s association with a trusted infrastructure provider underscores the need for heightened scrutiny. No record of inclusion in Google Safe Browsing (GSB) or major blocklists was found during routine checks, indicating recent activation or evasion tactics.

Current status remains active, with no observed takedown or mitigation by hosting provider Google. Immediate response includes blocking the domain at DNS/endpoint levels and flagging the IP (142.251.141.65) for further investigation. Remaining risk is elevated due to the domain’s legitimate infrastructure ties and the potential for prolonged abuse. Users should avoid interaction and report any accidental exposure to their security teams for credential rotation and incident logging.