jravanoxsigs[.]click

The domain jravanoxsigs.click was registered on August 03, 2025 through Global Domain Group LLC and resolves to the IPv4 address 163.61.188.5, which is allocated to AS153568 NEW DHAKA HARDWARE in the United States. The authoritative name servers listed for the zone are dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, and dns4.lytehosting.com. No SSL/TLS certificate is presented for the site, indicating that the service is reachable only over HTTP. The page title returned by the server is "Jravanox Sigs – Safe investment with Jravanox Sigs," suggesting an investment‑oriented lure, but the page content has not been publicly examined, leaving the exact phishing vector uncertain.

VirusTotal has recorded ten detections out of ninety‑five scanning engines, confirming that multiple security products consider the domain malicious. The domain appears on a single external security blocklist and is specifically blocked by the PhishDestroy feed, reinforcing its classification as a brand‑impersonation threat targeting Google. Gridinsoft assigns the domain a trust score of 0 out of 100, and the overall risk rating is elevated.

The site is currently marked offline, but historical evidence indicates it was used to impersonate Google, likely to harvest credentials or deceive users with a fraudulent investment narrative. Defenders should continue to block both the domain and its associated IP address at perimeter controls, add the domain to internal blocklists, and monitor for any re‑activation or related infrastructure. Further analysis of the HTTP response body, if the site reappears, would be required to detail the exact user‑facing content and validate the phishing technique employed.