jojo-resmiadresleri[.]xyz

This domain, jojo-resmiadresleri.xyz, was registered on May 18, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active. The authoritative name servers are autumn.ns.cloudflare.com and guss.ns.cloudflare.com, which route traffic through a common content‑delivery network. DNS resolution points to IP address 188.114.96.3, located in Canada. The site presents a Let’s Encrypt (E7) SSL certificate and returns an HTTP 403 status code with the page title “Just a moment…”. Security telemetry shows a Gridinsoft trust score of 0/100 and the domain appears on one blocklist. It is referenced in a single AlienVault OTX pulse and is currently blocked by PhishDestroy. VirusTotal analysis recorded five detections out of ninety‑two scanners, confirming malicious classification. The identified threat type is credential phishing, and the risk level is high. While the exact phishing landing page content has not been publicly disclosed, the combination of low trust score, blocklist presence, multiple vendor detections, and active hosting suggests a deliberate campaign to harvest credentials. Defenders should add the domain and its resolving IP to deny‑list rules, monitor DNS queries for the associated nameservers, and consider enforcing TLS inspection to capture any credential submissions. Continuous threat‑intel feeds should be consulted for any new indicators, and incident response teams should be prepared to investigate any compromised accounts that may be linked to this infrastructure.