# PhishDestroy threat dossier — jingruijx.com ================================================================ Fetched: 2026-05-07 10:35:11 UTC Canonical: https://phishdestroy.io/domain/jingruijx.com/ ## VERDICT ---------------------------------------------------------------- STATUS STALE — last probed 19 days ago, treat as ACTIVE until re-verified Composite threat score: 87/100 (PhishDestroy scoring — see methodology below) Scam classification: Social Media Phishing ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/95 security vendors flagged this domain Flagging vendors: Gridinsoft Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 154.198.133.213 (US, New York City) ASN: ASAS328608 Africa-on-Cloud-AS, ZA Hosting org: AS11427 Charter Communications Inc Registrar: Gname.com Pte. Ltd. Nameservers: ["a6.share-dns.com", "b6.share-dns.net"] Registered: 2026-02-21 Page title: 嘉盛集团|全球外汇投资平台-FOREX嘉盛官网 HTTP response: 515 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: CDN Data Center / CDN Server Data Center Expires: 2099-12-31 Status: INVALID chain Fingerprint: 62a9c9e6571926df504307d3f2a8ba438625d53c9e0445f8a61009da5a6c6c63 Subject Alternative Names (related infrastructure — often same operator): - cdn.data.center - cdn.server ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-02-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-26 23:21:42 UTC (by PhishDestroy tracker) Last verified: 2026-04-17 13:15:58 UTC (STALE — 19 days ago, re-verify) Flagged dead: 2026-03-02 20:22:42 UTC (NOT RE-VERIFIED IN 19 DAYS — treat as unconfirmed) Current status: UNCONFIRMED (our live-probe is 19 days stale) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/05eaa6e4-97a4-46a3-8ae1-c7283dbfac9e/ Wayback Machine: https://web.archive.org/web/*/jingruijx.com crt.sh CT logs: https://crt.sh/?q=%25.jingruijx.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=jingruijx.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/jingruijx.com URLhaus: https://urlhaus.abuse.ch/host/jingruijx.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-03-24 00:53:34 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies jingruijx.com as a low-risk generic phishing domain impersonating 嘉盛集团, a global forex investment platform. The domain aims to deceive users by mimicking the official FOREX 嘉盛官网 to harvest sensitive data or credentials. Supporting evidence includes the domain’s creation date on February 21, 2026, and registration via Gname.com Pte. Ltd. It resolves to IP 154.198.133.213 and appears on two security blocklists. Although VirusTotal flags only 1 out of 95 security vendors, this indicates some detection activity. The site’s page title closely replicates that of the legitimate 嘉盛集团 forex platform, further confirming its impersonation intent. Currently, jingruijx.com is taken offline, mitigating immediate threats to users. To reduce exposure, users should avoid interacting with this domain and rely solely on verified official websites for forex investments. Continuous monitoring and blocking measures remain recommended to prevent potential phishing attempts from similar domains. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: cbef38f31da907d7398c6245d340bce5 TLS cert SHA-256: 62a9c9e6571926df504307d3f2a8ba438625d53c9e0445f8a61009da5a6c6c63 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/jingruijx.com/ JSON API: https://api.destroy.tools/v1/check?domain=jingruijx.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 146,807 domains (58,449 alive under monitoring, 88,096 confirmed takedowns/dead). Site: https://phishdestroy.io