jhfoto[.]cz

PhishDestroy identifies the domain jhfoto.cz as an active generic phishing campaign classified as a crypto drainer. This domain is designed to mimic a legitimate crypto service login page, tricking users into entering their credentials and wallet information. The campaign leverages a false sense of legitimacy through an SSL certificate issued by DigiCert Inc, which may deceive users into believing the site is secure. Technical analysis indicates this domain is part of a broader effort to harvest cryptocurrency assets by exploiting trust in familiar login interfaces.

This domain was flagged with a VirusTotal detection score of 0/95, indicating no security vendors currently flag it as malicious. It was registered on October 03, 2005, through the registrar REG-MOJEID, and resolves to the IP address 217.198.114.178. As of the latest scan, the domain has not been listed on Google Safe Browsing (GSB) and remains unblocked by major threat intelligence platforms. The longevity of the domain registration raises concerns about potential reuse in future campaigns, despite its current lack of detections.

The campaign is currently active, with no immediate blocklist presence, posing a significant risk to users who may unknowingly interact with the domain. PhishDestroy is monitoring this domain for further malicious activity and advises users to exercise extreme caution when accessing crypto-related login pages. The remaining risk is high due to the domain’s age, SSL certificate, and current lack of detections, which may allow it to evade traditional security measures. Users should verify the legitimacy of any crypto service login page using PhishDestroy’s tools to prevent asset loss.