jnlsslc[.]com

PhishDestroy identifies jnlsslc.com as an active credential theft domain leveraging generic phishing tactics to harvest user login credentials. This domain does not impersonate a specific brand but instead employs broad, unsophisticated lures to trick users into submitting sensitive information. The infrastructure lacks overt red flags such as a known drainer kit (e.g., Angel Drainer, Inferno Drainer), suggesting opportunistic rather than targeted operations. The domain’s longevity since November 2020 indicates sustained malicious activity, with threat actors likely recycling the domain for repeated low-volume campaigns aimed at credential harvesting across multiple platforms. This domain is tracked under seed a6d471 and exhibits multiple indicators of compromise. VirusTotal shows 23 out of 95 security vendors flagged the domain as malicious as of the latest scan. The domain was registered through Gname.com Pte. Ltd., a registrar frequently associated with bulk domain registrations linked to fraudulent activity. It resolves to IP address 45.135.237.29, hosted on infrastructure historically accommodating phishing and malware delivery campaigns. The domain was created on November 22, 2020, indicating nearly three years of active use. Notably, it is secured with a Let's Encrypt SSL certificate, which threat actors commonly exploit to bypass browser security warnings. While Google Safe Browsing (GSB) status data was not specified, the domain’s detection rate and sustained activity across multiple security platforms strongly suggest inclusion in several reputation blocklists, though exact blocklist counts remain unverified at this time. As of the latest assessment, jnlsslc.com remains active and poses an elevated risk to users who may interact with it, particularly through deceptive email or social media campaigns promoting fake login portals. Immediate safety recommendations include blocking the domain and IP address at the network perimeter and instructing end-users to avoid accessing the domain entirely. While active takedowns or sinkholing measures are not confirmed, users should treat this domain as untrusted and consider it a persistent threat vector. The low VT ratio (23/95) relative to total vendors suggests uneven detection, underscoring the need for proactive monitoring and user education to mitigate credential theft risks. Users concerned about exposure should audit stored credentials and enable multi-factor authentication wherever possible.