jennygraig[.]com

Analysis indicates that the domain jennygraig.com remains active as of 26 July 2026 and is being leveraged in a credential‑harvesting operation. The domain resolves to the authoritative nameservers ns1.emu-dns.com and ns2.emu-dns.com, both of which are commonly associated with disposable or rapidly‑re‑hosted infrastructure used by threat actors. HTTP requests to the site return a 302 redirect, a pattern frequently employed to conceal the final malicious landing page or to route victims through intermediate tracking services.

Registrar information shows the domain was registered through SNAPNAMES 54, LLC, a registrar that has appeared in prior abuse reports, suggesting a low barrier to acquisition. The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy feed, confirming that at least one defensive organization has observed malicious activity linked to it. VirusTotal scans show that 2 of 91 security vendors flagged the domain, providing independent corroboration of its malicious reputation.

The limited public data does not reveal the underlying hosting IP, SSL certificate details, or the exact content served after the redirect, leaving the full attack chain partially opaque. Defenders should continue to block the domain at perimeter and DNS layers, monitor for outbound connections to the associated nameservers, and incorporate the indicator into threat‑intel feeds. Additional investigation, such as retrieving the final URL after the 302 response and examining any hosted payloads, would reduce uncertainty and improve detection rules.