jploganbk[.]com

This domain, jploganbk.com, has been identified as a brand impersonation phishing site targeting JPlogan Bank, a financial foundation. The domain is currently offline, but prior analysis indicates it was actively used to deceive users by mimicking the legitimate JPlogan Bank portal. The page title, 'Home - JPlogan Bank,' directly replicates the branding of the targeted institution, increasing the likelihood of successful social engineering attacks against unsuspecting victims. Analysis of the domain reveals it was registered on September 15, 2025, through Dynadot LLC, a registrar commonly associated with malicious infrastructure. The domain resolved to the IP address 198.12.80.250, hosted on AS36352 (HostPapa) in the United States. Security vendors on VirusTotal flagged the domain as malicious, with 14 out of 95 vendors detecting it as a phishing or brand impersonation threat. Additionally, the domain appeared on one security blocklist, further corroborating its malicious nature. The SSL certificate was issued by Google Trust Services (WE1), a detail often exploited by threat actors to lend false legitimacy to phishing sites. The domain has since been taken offline, likely due to remediation efforts by security teams or hosting providers. However, organizations and users should remain vigilant, as similar domains may emerge using comparable tactics. Recommended actions include monitoring for newly registered domains containing 'jplogan' or similar variations, implementing DNS-based blocking for the identified IP (198.12.80.250), and educating users on recognizing brand impersonation attempts. Network defenders should also review logs for connections to the domain or associated IP to identify potential prior compromise.