shopee-tbk888[.]blogspot[.]com

This domain, shopee-tbk888.blogspot.com, is flagged for hosting a fake rewards phishing campaign targeting users through deceptive promotional offers. The threat type is classified as generic_phishing with an elevated risk level, indicating a high likelihood of credential theft or financial fraud through social engineering tactics. Infrastructure analysis reveals the domain resolves to IP address 142.250.31.132, geolocated in Germany under autonomous system AS15169 (Google LLC). The domain was registered through the Google Blogger platform, which is commonly exploited for low-cost phishing deployments. Detection metrics show 19 out of 95 security vendors on VirusTotal flagged the domain as malicious. The page title, 'Hadiah shopee 2020,' explicitly references outdated promotional content to lure victims. The domain appears on one security blocklist and was proactively blocked by at least one anti-phishing system before being taken offline. To mitigate risks associated with this threat type, organizations should implement real-time domain reputation checks for newly observed subdomains on free hosting platforms. Network-level blocking of the resolved IP (142.250.31.132) is recommended for environments where legacy phishing campaigns remain active. User awareness training should emphasize verification of promotional offers through official channels only, particularly for campaigns referencing outdated years or events. Security teams are advised to monitor for similar patterns, such as 'Hadiah' or '2020' in page titles, as indicators of ongoing phishing operations.