jcmrx[.]org

The domain jcmrx.org was observed on July 12, 2026 and classified as a high‑risk generic phishing site. Analysis flags the domain as active with a current HTTP 200 response, indicating that the malicious landing page is reachable. The page title “Welcome to our Direct Email Contact and Order Page” aligns with typical credential‑harvesting lures that promise direct communication and order processing.

Infrastructure assessment shows that jcmrx.org resolves to the IPv4 address 146.70.118.228, which is hosted in Germany and associated with AS9009 (M247 Europe SRL). The domain was registered on February 27, 2026 through Key‑Systems GmbH and uses four monovm.host nameservers (ns1‑ns4.monovm.host). A Let’s Encrypt R13 certificate secures the site, confirming the use of a free TLS service. The presence of HTTP/3 indicates a relatively modern web server configuration.

Reputation data further corroborates malicious intent. The Gridinsoft trust score is 0 out of 100, and the domain appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports that 2 of 95 scanned security vendors have flagged the domain, reinforcing the suspicion despite a low detection count. MX records are configured with priority 0 pointing to jcmrx.org itself, a pattern often employed to capture inbound email traffic for credential harvesting.

Defenders should treat jcmrx.org as a confirmed phishing infrastructure and enforce immediate blocking at network and DNS layers. Continuous monitoring of the associated IP 146.70.118.228 is advised, as the host may serve additional malicious payloads or be reused for future campaigns. Email security gateways should reject or quarantine messages directed to the domain’s MX host, and any observed traffic to the site should be logged for forensic correlation. Updating threat‑intel feeds with the observed indicators will aid broader community mitigation.