tjg-rju-edi-zjw-org-rfj-efu[.]netlify[.]app

This domain, tjg-rju-edi-zjw-org-rfj-efu.netlify.app, is flagged as a generic phishing site with an elevated risk level after being taken offline on July 24, 2026. Registered through Netlify on May 9, 2018, the domain resolves to an IP address (98.84.224.111) hosted on Amazon.com, Inc. infrastructure (AS14618) in the United States. The page title, 'Connect & Unlock,' suggests an attempt to mimic a login or authentication portal, though the exact brand or service targeted remains unconfirmed due to the lack of additional brand-specific indicators in the available data. Infrastructure analysis reveals the domain was served via Netlify’s platform, with HSTS enabled, and secured by a DigiCert Global G2 TLS RSA SHA256 2020 CA1 SSL certificate.

At the time of assessment, the domain returned an HTTP 404 status, indicating it was no longer actively serving content. It appears on one security blocklist, and three out of 93 security vendors on VirusTotal flagged the domain as malicious. The nameservers (dns1.p01.nsone.net through dns4.p01.nsone.net) are consistent with Netlify’s standard configuration, providing no additional anomalies. Defenders should note that while the domain is currently offline, its historical activity and detection by multiple security vendors warrant continued monitoring.

The absence of a confirmed phishing kit or brand target limits the ability to attribute the campaign to a specific threat actor or sector. Organizations are advised to block the domain at the DNS or proxy level and review logs for prior connections to the IP address 98.84.224.111. If internal users report interactions with this domain, initiate standard phishing response procedures, including credential resets and device scans for potential compromise.