info-resmi8-9[.]blogspot[.]com

This domain, info-resmi8-9.blogspot.com, is flagged for credential theft through brand impersonation targeting Shopee, a prominent e-commerce platform. Analysis indicates the threat actor designed the page to mimic legitimate Shopee login portals, likely harvesting user credentials for unauthorized account access or financial fraud. No evidence of a crypto drainer kit or direct financial exfiltration script was observed, but the credential harvesting mechanism aligns with common phishing tactics employed in retail sector impersonation campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through MarkMonitor, Inc., a registrar frequently utilized for both legitimate and malicious domains. The domain resolves to IP address 142.251.36.97, hosted under AS15169 (Google LLC) in Germany, leveraging Google’s blogspot.com subdomain infrastructure. The SSL certificate is issued by Google Trust Services (WE2), providing a veneer of legitimacy. Detection metrics show 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one additional security blocklist. Google Safe Browsing (GSB) had not yet classified the domain at the time of analysis, though this may reflect a lag in propagation rather than benign status. As of the latest assessment, the domain has been taken offline, likely following automated or manual takedown procedures. The response action appears effective in mitigating immediate user exposure, though residual risk persists for users who may have interacted with the domain prior to its deactivation. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication (MFA) to mitigate account takeover risks. Users should verify domain authenticity before entering credentials, particularly on platforms mimicking high-value retail brands.