info-resmi991[.]blogspot[.]com

This domain, info-resmi991.blogspot.com, is actively engaged in brand impersonation targeting ShopeePay, a digital payment service. The threat type is classified as high-risk due to its deceptive mimicry of legitimate ShopeePay login and transaction pages. As of the latest assessment, the domain remains operational and continues to host content designed to mislead users into divulging sensitive credentials or financial information. Analysis indicates the domain is flagged by 20 of 95 security vendors on VirusTotal, reflecting a significant level of detection despite its active status. Infrastructure analysis reveals the domain resolves to the IP address 142.251.127.132, which is associated with Google-hosted services. The SSL certificate is issued by Google Trust Services, a common characteristic of legitimate and malicious domains alike hosted on Blogspot. The page title explicitly displays 'shopee,' further confirming its intent to impersonate the ShopeePay brand. No historical registration data or creation date is available for this subdomain, as it operates under the blogspot.com parent domain, which is managed by Google. The current status of info-resmi991.blogspot.com remains active, posing an ongoing risk to users who may encounter it through phishing campaigns, malicious advertisements, or compromised links. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include the domain and its resolving IP address. Users should be educated to verify the authenticity of payment portals by cross-referencing URLs with official ShopeePay domains and looking for signs of deception, such as mismatched SSL certificates or unusual subdomains. Security teams are recommended to monitor for related indicators of compromise, including the IP address 142.251.127.132, and investigate any potential exposure within their environments.