shopee2899[.]blogspot[.]com

This domain, shopee2899.blogspot.com, operates as a credential harvesting phishing page targeting users of the legitimate e-commerce platform Shopee. The site presents a fraudulent login interface designed to capture usernames and passwords entered by victims, which are then transmitted to threat actors for account takeover or financial fraud. Analysis of the page title and visual elements confirms the site is impersonating the official Shopee brand to deceive users into believing they are accessing a genuine service. Infrastructure analysis reveals the domain is hosted on Google Blogger, a free platform frequently abused for phishing due to its accessibility and trusted reputation. The site resolves to IP address 142.251.13.132, located in Germany under AS15169 (Google LLC), and uses an SSL certificate issued by Google Trust Services. Detection data from VirusTotal indicates 19 out of 95 security vendors have flagged this domain as malicious, while one additional security blocklist has also listed it. The domain remains active as of the latest verification, posing an ongoing threat to unsuspecting users. Users who have visited shopee2899.blogspot.com or entered credentials on the site should immediately take corrective action. First, change the password for the affected Shopee account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication on all critical accounts to prevent unauthorized access. Monitor the account for suspicious activity, such as unauthorized purchases or profile changes, and report any anomalies to the legitimate platform. If financial information was entered, contact the relevant financial institution to secure accounts and review recent transactions for fraud. Avoid interacting with the domain or any links associated with it, and report the phishing site to the hosting provider and relevant cybersecurity organizations to aid in takedown efforts.