info-resmi919[.]blogspot[.]com

This domain, info-resmi919.blogspot.com, is flagged for elevated-risk credential theft targeting users of the e-commerce platform Shopee. Analysis indicates the threat actor created a fraudulent login portal under the page title 'shopee' to harvest account credentials, enabling subsequent unauthorized access to victim accounts, financial data, or personal information. The campaign demonstrates targeted brand impersonation rather than generic phishing, increasing its effectiveness against platform users familiar with legitimate login interfaces. Infrastructure analysis reveals the domain was registered through Google Blogger, leveraging the platform's free hosting and SSL certificate issued by Google Trust Services. The domain resolved to IP address 142.251.20.132, a Google-owned infrastructure node commonly associated with legitimate services, which may have delayed detection. Detection metrics show 15 of 95 security vendors flagged the domain on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was specifically blocked by PhishDestroy. Technologies detected include Blogger's hosting framework, Java, Python, OpenGSE, and HTTP/3, suggesting the use of automated tools for rapid deployment and evasion of basic security controls. Mitigation against credential theft campaigns of this nature requires multi-layered defenses. Organizations should implement domain monitoring to detect newly registered subdomains on free hosting platforms that impersonate their brand, particularly those using SSL certificates from major providers. End users should verify domain authenticity by checking for subtle misspellings or unusual subdomains before entering credentials, and enable multi-factor authentication on all accounts to prevent unauthorized access even if credentials are compromised. Security teams should prioritize blocking known malicious IPs and domains at the network perimeter, while also conducting phishing awareness training that specifically addresses brand impersonation tactics on free hosting services.