gebyar-shopee71[.]blogspot[.]com

Analysis of gebyar-shopee71.blogspot.com shows that the domain is hosted on Google’s Blogger platform and resolves to the Google Cloud IP 142.250.217.1 (AS15169, United States). The domain was registered on July 31, 2000 through MarkMonitor, Inc., and uses Google’s default name servers (ns1‑ns4.google.com). TLS is provided by Google Trust Services under the WE2 certificate, indicating a legitimate Google‑issued certificate but offering no protection against abuse of the underlying account. HTTP requests return a 404 status with the page title “Blog not found”, confirming that no content is currently served.

The site was classified as an e‑commerce phishing scam, and the blocklist PhishDestroy has already listed it as offline. VirusTotal reports ten detections out of ninety‑five scanners, and the domain appears on one additional security blocklist, reinforcing the risk assessment. Technologies identified include Blogger, Java, Python, OpenGSE, and support for HTTP/3, all typical of a standard Blogger deployment. No additional intelligence such as specific credential‑stealing pages or phishing kits has been observed, leaving the exact malicious payload unknown.

Defenders should continue to block the domain at perimeter filters, monitor for any re‑activation, and consider adding the IP address to reputation lists. Because the TLS certificate is valid, users may be misled by the appearance of HTTPS; user education should stress verification of the actual site content rather than reliance on the lock icon. Ongoing observation of the domain’s registration and DNS records is advised to detect potential changes that could signal a re‑use of the infrastructure for future campaigns.