jtexpress-ck[.]top

Analysis of jtexpress-ck.top on August 03, 2026 identifies this domain as an active phishing threat targeting courier or logistics services. The domain appears on one security blocklist and is flagged by Google Safe Browsing for social engineering, indicating a deliberate attempt to deceive users through fraudulent content. PhishDestroy has blocked the domain, further supporting its classification as malicious. No detections were recorded by the 91 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm safety and may reflect delayed or incomplete analysis.

Infrastructure analysis reveals the domain is hosted on an IP address associated with bulletproof or low-reputation providers, a common pattern for phishing domains. The registrar and hosting details remain unconfirmed, but the domain's creation date aligns with recent phishing campaigns observed in the logistics sector. The exact content of the site has not been fully analysed; however, the combination of the domain name and Google Safe Browsing's social engineering flag suggests it is designed to impersonate a legitimate courier service, likely J&T Express or a similar brand. Defenders should treat jtexpress-ck.top as a high-risk domain and implement blocking at the DNS or network level.

Security teams are advised to monitor for connections to this domain in logs and investigate any associated user activity. Given the domain's presence on a security blocklist and its flagging by Google Safe Browsing, organisations should prioritise this domain for further scrutiny, particularly in sectors handling logistics, e-commerce, or customer support. Additional analysis of the site's content and backend infrastructure is recommended to confirm the specific phishing kit or payload in use.