info-resmi699[.]blogspot[.]com

This domain, info-resmi699.blogspot.com, operates as a credential theft site specifically targeting users of the Shopee e-commerce platform. Analysis indicates the site presents a fraudulent login interface mimicking Shopee’s official design, tricking victims into submitting their account credentials. The primary threat involves unauthorized access to user accounts, leading to financial fraud, unauthorized purchases, or further exploitation through stored payment methods. The site may also distribute malware under the guise of promotional offers or account verification prompts, compounding the risk to visitors. Infrastructure analysis reveals concrete indicators of malicious activity. The domain resolves to the IPv6 address 2a00:1450:4001:c17::84, hosted under AS15169 (Google LLC) in the United States, and is registered through Google Blogger, a common platform for low-effort phishing campaigns. Security vendors on VirusTotal flagged the domain at a rate of 17/95, with one active blocklist entry confirming its malicious classification. The SSL certificate, issued by Google Trust Services (WE2), provides no legitimacy, as phishing sites frequently abuse free or automated certificate issuance to appear trustworthy. The page title explicitly references 'SHOPEE,' further corroborating the brand impersonation tactic. Users who visited info-resmi699.blogspot.com should immediately take remedial actions to mitigate potential compromise. First, reset passwords for Shopee and any other accounts where identical credentials may have been reused, prioritizing accounts linked to financial services. Enable multi-factor authentication (MFA) on all critical platforms to prevent unauthorized access. Monitor transaction histories for unauthorized activity and report suspicious charges to the platform and financial institutions. If the site prompted downloads or software installations, perform a full system scan using updated security tools to detect and remove potential malware. Finally, report the domain to relevant abuse channels, including the hosting provider (Google Blogger) and anti-phishing organizations, to aid in takedown efforts.