participate-3jane[.]xyz

Analysis of participate-3jane.xyz shows a newly registered domain created on June 25, 2026 that is currently taken offline. The domain resolves to the Cloudflare‑managed address 172.67.198.18, which is geolocated to Canada and served through Cloudflare’s edge network, employing HSTS and HTTP/3. The SSL certificate is issued by Google Trust Services under the WE1 certificate authority, indicating a valid TLS handshake but offering no assurance of legitimacy. Registrar information lists NICENIC INTERNATIONAL GROUP CO., LIMITED as the sponsoring entity, and the domain’s nameservers are jen.ns.cloudflare.com and kanye.ns.cloudflare.com, both standard Cloudflare resolvers.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of confidence in the domain’s reputation. VirusTotal scans have flagged the domain on five of ninety‑one security engines, confirming that multiple vendors have identified malicious characteristics. The domain appears on a single public blocklist and has been specifically blocked by PhishDestroy, reinforcing its classification as a phishing vector.

While the offline status limits immediate threat exposure, the combination of a fresh registration, low trust score, multiple vendor detections, and active blocklisting suggests a purposeful phishing campaign. Defenders should continue to monitor DNS queries for resolve attempts to 172.67.198.18, enforce outbound filtering for the domain, and ensure that any residual email or credential harvesting attempts are quarantined. Updating internal blocklists with the domain and sharing the indicators of compromise with threat‑sharing communities will help prevent future exploitation.