jeogax[.]com

PhishDestroy identifies jeogax.com as an active generic phishing domain posing an elevated risk to unsuspecting users. This website was created on March 14, 2026, and operates under a Let's Encrypt SSL certificate, which may lend it a false sense of legitimacy. The domain resolves to IP address 172.67.197.78 and is registered through GMO Internet, Inc., a Japan-based hosting provider. Security vendor detection remains low, with only 1 out of 95 VirusTotal scanners flagging this domain as malicious at the time of analysis. No specific brand or drainer kit attribution has been established for this campaign, suggesting opportunistic rather than targeted phishing activity.

This domain exhibits several technical indicators that warrant heightened caution. VirusTotal’s detection ratio stands at 1/95 security vendors, indicating poor recognition of the threat by automated systems. The domain was registered through GMO Internet, Inc., a legitimate registrar, which complicates efforts to attribute malicious intent solely based on registration metadata. The IP address 172.67.197.78 is associated with Cloudflare infrastructure, a common hosting environment for both legitimate and malicious sites. The domain’s creation date of March 14, 2026, suggests it is a relatively new addition to the threat landscape. As of the latest assessment, jeogax.com has not been widely blocked by Google Safe Browsing (GSB) or other major threat intelligence platforms, which may contribute to its continued accessibility.

Jeogax.com remains in an active state, with no immediate signs of takedown or remediation. The elevated risk level reflects its potential to deceive users through social engineering tactics, particularly if leveraged in spam campaigns or malicious advertisements. Security researchers and end-users are advised to avoid interacting with this domain and to report any observed activity to relevant threat intelligence platforms. While the current detection rate suggests limited spread, the absence of widespread blocklisting means the domain could proliferate rapidly. Users should exercise extreme caution when encountering links to jeogax.com and consider it a confirmed phishing threat until further evidence suggests otherwise.