info-resmi8-8[.]blogspot[.]com

This domain, info-resmi8-8.blogspot.com, operates as a credential harvesting portal targeting users of the Southeast Asian e-commerce platform Shopee. The site presents a counterfeit login interface designed to capture usernames, passwords, and potentially payment details from unsuspecting victims attempting to access their accounts. Infrastructure analysis reveals the page title explicitly displays 'SHOPEE', confirming its intent to deceive users into believing they are interacting with the legitimate service. Evidence supporting this assessment includes detection by 18 out of 95 security vendors on VirusTotal, with the domain appearing on one security blocklist. The domain was registered through Google LLC on March 2, 2026, and resolves to IP address 142.251.127.132, hosted within Google's autonomous system (AS15169). The SSL certificate, issued by Google Trust Services with identifier WE2, indicates the use of encrypted connections to lend false legitimacy to the phishing attempt. Despite being taken offline, the domain's creation date suggests potential for reactivation or reuse of associated infrastructure. Users who visited info-resmi8-8.blogspot.com should immediately change their Shopee account passwords using a secure device and enable multi-factor authentication if available. All credentials entered on this domain should be considered compromised and revoked from any other services where they may have been reused. Monitor financial statements for unauthorized transactions, as payment details may also have been exposed. Security teams should add this domain to blocklists and investigate any connections to 142.251.127.132 within their network logs for signs of compromise.