mjunioevaluate[.]mobi

This domain, mjunioevaluate.mobi, is currently flagged as an active credential phishing threat with a high-risk classification. Registered on May 19, 2026, through a hosting provider, the domain resolves to a German-based IP address, 159.100.6.19, operated by a known infrastructure provider. Analysis indicates the domain is still active despite returning an HTTP 403 status, which may suggest restricted access or a staging phase for malicious content. It appears on one security blocklist and has been documented in a threat intelligence pulse, reinforcing its association with phishing operations. Infrastructure analysis reveals the domain relies on nameservers managed by the same hosting provider, a pattern often observed in phishing campaigns to maintain control over DNS records and evade takedowns. The SSL certificate, issued by Let's Encrypt, is valid but does not mitigate the risk, as phishing sites frequently use legitimate certificates to appear trustworthy. The presence of LiteSpeed and HTTP/3 technologies suggests modern web hosting capabilities, which may be leveraged to improve site performance or evade detection mechanisms. Notably, the domain's MX records point back to itself, a tactic sometimes used to intercept email communications or validate stolen credentials. Security vendors have flagged mjunioevaluate.mobi with a detection ratio of 4 out of 95, indicating moderate consensus on its malicious nature. While the exact phishing kit or targeted brand remains unconfirmed, the domain's infrastructure aligns with known phishing patterns, including the use of a newly registered domain and hosting in a region with lenient enforcement. Defenders should treat this domain as hostile and implement blocking measures at the DNS or network level. Monitoring for related domains registered under the same provider or IP range may help identify additional threats from the same actor.