hasilundianresmishopee[.]blogspot[.]com

The domain hasilundianresmishopee.blogspot.com is an active generic phishing threat specifically designed to impersonate the e-commerce platform Shopee for credential theft. Currently live and posing as a legitimate Shopee prize draw page, it aims to trick users into divulging sensitive login information or personal details. This domain was flagged by 6 of 95 VirusTotal security vendors as malicious, indicating a moderate but notable level of detection across the security community. It resolves to IP address 142.251.13.132 and is registered through Google Blogger, a free blogging platform often abused for hosting phishing pages. The SSL certificate is issued by Google Trust Services with the identifier WE2, lending a false sense of legitimacy to the site. The domain appears on one security blocklist and is still active at the time of analysis, underscoring the ongoing risk to users.

PhishDestroy assesses this domain as high risk due to its direct impersonation of a well-known brand and its use for credential harvesting. The page title "SHOPEE" is a deliberate misspelling of the legitimate brand name "Shopee," a common tactic to evade automated detection while remaining convincing to casual users. The combination of a free hosting service, a low but present blocklist presence, and active status suggests that the attackers are actively maintaining the phishing infrastructure. Users who encounter this domain should be aware that any information submitted, such as login credentials or personal data, will be captured by malicious actors.

It is strongly recommended that users do not interact with this domain under any circumstances. If you have already visited the site and entered credentials, immediately change your Shopee account password and enable two-factor authentication. Report the domain to Google Safe Browsing and your email provider to help protect others. Stay vigilant against unsolicited messages promoting prize draws or contests, especially those that require login through external links, as they are common vectors for such phishing attacks.