info-resmi782[.]blogspot[.]com

This domain is flagged as an elevated-risk phishing site specializing in brand impersonation, specifically targeting users of the e-commerce platform Shopee. Analysis indicates the site operates as a fake login portal designed to harvest credentials, a tactic consistent with credential-theft phishing campaigns. The page title explicitly references 'shopee,' reinforcing the targeted deception against users expecting legitimate Shopee services. Infrastructure analysis reveals the domain was registered through Google Blogger, a common platform exploited for low-cost phishing deployments. The site resolves to IP address 192.178.183.132 and is currently offline, though prior activity was detected by 15 out of 95 security vendors on VirusTotal. It appears on one security blocklist and holds a trust score of 0/100, indicating high confidence in its malicious classification. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, with an SSL certificate issued by Google Trust Services, which provides a false sense of legitimacy to potential victims. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain and its resolving IP at firewall and proxy levels, while also monitoring for internal access attempts. End users who may have interacted with the site should reset credentials for Shopee and any accounts where passwords were reused, enabling multi-factor authentication where available. Security teams should review logs for connections to 192.178.183.132 and inspect endpoints for signs of credential theft or unauthorized access. Given the use of Blogger-hosted infrastructure, monitoring for similar patterns (e.g., newly created blogspot subdomains with brand-related keywords) is recommended for proactive detection of related threats.