shopee815[.]blogspot[.]com

PhishDestroy identifies active fake-login phishing infrastructure at shopee815.blogspot.com (seed f00265). The campaign mimics the legitimate Shopee e-commerce platform to harvest user credentials and session tokens. No cryptocurrency drainer payloads are observed in automated sandbox detections; the primary objective is account takeover for subsequent fraudulent purchases or payment-redirection scams.

Technical indicators align with an elevated-risk profile. VirusTotal reports 11 of 95 engines flagging the domain; infrastructure resolves to Google IP 172.217.168.65 via Blogger’s hosting. Registrar is MarkMonitor, and the Blogger subdomain was created in early 2024 (creation date redacted in public feeds). Google Safe Browsing currently lists the domain as unsafe, and public blocklists count 12 third-party detections, reinforcing the malicious classification.

The domain remains ACTIVE as of the latest crawl. Google has not yet suspended the Blogspot instance despite multiple vendor alerts. Users are advised to avoid visiting the URL and to scan any received links with PhishDestroy before interaction. Remaining risk is elevated due to the trusted Blogger domain space and the ongoing absence of takedown intervention.