infoshopee575[.]blogspot[.]com

This domain is flagged for hosting a credential harvesting phishing operation targeting users of the e-commerce platform Shopee Indonesia. Analysis indicates the infrastructure is designed to deceive victims into submitting login credentials, payment details, or personal information through a fraudulent interface mimicking the legitimate Shopee Indonesia website. The threat type is classified as elevated due to the domain's active exploitation of brand impersonation and its potential to facilitate financial fraud or identity theft. Infrastructure analysis reveals the domain infoshopee575.blogspot.com was registered through Google Blogger, a platform frequently abused for low-cost phishing deployments. The page title, SHOPEE INDONESIA, confirms the targeted brand, while the domain resolves to the IP address 192.178.155.132, geolocated in Germany under AS15169 (Google LLC). Detection metrics show the domain is flagged by 18 out of 95 security vendors on VirusTotal, with one confirmed entry on a security blocklist. The domain has since been taken offline, though historical data indicates it was actively serving malicious content prior to removal. Mitigation steps for organizations and end-users include implementing DNS-based blocking of the domain and its associated IP address (192.178.155.132) to prevent access. Security teams should monitor for indicators of compromise, such as unauthorized login attempts or unusual transaction patterns linked to Shopee accounts. End-users are advised to verify the authenticity of any Shopee-related communication by cross-referencing URLs with the official domain (shopee.co.id) and enabling multi-factor authentication to reduce the risk of credential theft. Given the domain's prior activity, retrospective analysis of logs for connections to 192.178.155.132 is recommended to identify potential breaches.