shopeeday-11-11[.]blogspot[.]com

Analysis as of July 29 2026 indicates that the Blogger-hosted subdomain shopeeday-11-11.blogspot.com is actively being used for phishing. The domain is registered through Google Blogger, which provides default DNS configuration; the nameserver query returned NS_NOT_FOUND, consistent with Blogger’s managed hosting. The subdomain resolves to the IP address 142.250.154.132, an address owned by Google’s infrastructure, confirming that the site is hosted on Google’s platform. Reputation services have placed the domain on one security blocklist, and the anti‑phishing service PhishDestroy currently blocks it.

VirusTotal scans show that 17 of 91 security vendors flagged the domain as malicious, providing independent corroboration of its abusive nature. No additional intelligence such as page title, brand targeting, or specific phishing kit has been published, so the exact content and lure employed by the site remain unknown. Defenders should continue to block the domain at network perimeter and DNS layers, add it to internal blacklists, and monitor for any new subdomains created under the same Blogger account.

Because the hosting provider is a large cloud service, rapid takedown requests to Google may be effective, but the account’s anonymity limits direct attribution. Continuous observation of the IP address and any future VirusTotal submissions is recommended to capture changes in detection rates. Organizations that rely on Google services should ensure that URL filtering solutions are updated with the latest blocklist entries to prevent end‑user exposure.