thrshopee16[.]blogspot[.]com

This domain, thrshopee16.blogspot.com, is identified as a generic phishing site targeting users through a fraudulent "Hadiah THR Shopee 2020" (Shopee THR Rewards 2020) lure. The page title explicitly references a seasonal rewards campaign, suggesting an attempt to exploit users expecting legitimate promotions from the Shopee e-commerce platform. No direct evidence of a drainer kit is observed, but the use of a Blogger-hosted page indicates a low-cost, high-volume phishing tactic designed to evade initial detection through reputable hosting infrastructure. Infrastructure analysis reveals the domain resolves to the IP address 142.251.20.132, associated with Google’s content delivery network. The site is registered through Google Blogger, leveraging its built-in SSL certificate issued by Google Trust Services. Detection metrics indicate 19 out of 95 security vendors flagged the domain as malicious on VirusTotal, while it appears on a single security blocklist. Technologies detected include Blogger, Java, Python, OpenGSE, and HTTP/3, consistent with standard Blogger-hosted environments. No creation date is publicly available due to the platform’s opaque registration process, but the campaign aligns with mid-2020 phishing trends. As of the latest assessment, thrshopee16.blogspot.com has been taken offline, likely following automated or manual takedown procedures. The domain was blocked by at least one threat intelligence feed prior to its removal. Despite its current inactive status, residual risk persists due to the potential for similar campaigns to emerge using comparable infrastructure or social engineering tactics. Organizations and users are advised to monitor for recurring phishing attempts leveraging seasonal promotions, particularly those hosted on free blogging platforms. Enforcement of domain reputation checks and endpoint protection rules is recommended to mitigate future exposure.