hadiahshopee-indonesia[.]blogspot[.]com

This domain, hadiahshopee-indonesia.blogspot.com, is identified as a generic phishing site targeting users of the e-commerce platform Shopee Indonesia. Analysis indicates the page masquerades as an official giveaway or promotional campaign under the title 'SHOPEE INDONESIA,' designed to harvest login credentials, payment details, or personal information from unsuspecting victims. The domain is currently offline, but prior activity confirms its malicious intent. Infrastructure analysis reveals the domain was registered through Google Blogger, leveraging its legitimate hosting services to evade initial detection. It resolves to the IP address 142.251.20.132, associated with Google’s infrastructure, and employs an SSL certificate issued by Google Trust Services. Detection metrics show the domain was flagged by 13 of 95 security vendors on VirusTotal, with one active security blocklist entry. Technologies detected include Blogger, Java, Python, OpenGSE, and HTTP/3, suggesting a blend of legitimate and potentially obfuscated components to facilitate phishing operations. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions or automated takedown mechanisms. However, users who may have interacted with the site should immediately revoke any shared credentials, monitor financial accounts for unauthorized activity, and report the incident to relevant fraud prevention authorities. Organizations are advised to update endpoint protection rules to block domains with similar patterns, such as impersonation of regional brands via free hosting platforms, and to conduct retrospective scans for indicators of compromise linked to 142.251.20.132 or the seed identifier be1e56.