pt-shopee0779[.]blogspot[.]com

PhishDestroy identifies the active domain pt-shopee0779.blogspot.com as a fake Shopee credential harvester distributing a generic JavaScript drainer kit via Blogspot-hosted phishing pages. Operators impersonate Shopee to trick users into entering payment card details and one-time passwords, with traffic redirected to decoy checkout portals that exfiltrate credentials and session tokens. The campaign relies on Blogspot’s free hosting and Google’s TLS infrastructure to appear legitimate, lowering victim suspicion during data entry. Domain technical indicators include zero detections on VirusTotal (20/95 engines) despite active hosting on AS15169 (Google LLC) IP 142.251.20.132; registration through Google Domains places creation date within the last 30 days. The SSL certificate issued by Google Trust Services enhances page authenticity, while absence from Google Safe Browsing and public blocklists indicates early-stage evasion. WHOIS shows privacy-protected registrant details aligned with typical Blogspot subdomain patterns. Current status remains active with live phishing pages serving content in Indonesian and English to target Shopee regional shoppers. Google’s infrastructure complicates immediate takedown, necessitating repeated reporting via Google’s abuse channels and Shopee’s fraud team. Remaining risk is assessed as high due to zero detection coverage and ongoing credential harvesting potential. Users should avoid clicking links from unsolicited messages claiming to be from Shopee, verify domains before input, and enable two-factor authentication on their Shopee accounts to mitigate compromise.