jackinthebox[.]wiki

This domain, jackinthebox.wiki, is currently under investigation for credential harvesting phishing activity targeting customers of the fast-food chain Jack in the Box. The site remains active and operational, presenting a cloned interface designed to capture login credentials, payment details, or other sensitive user information. Analysis indicates the infrastructure is structured to mimic legitimate corporate portals, increasing the likelihood of successful deception against unsuspecting visitors. Infrastructure analysis reveals the domain was registered on June 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The site resolves to the IP address 188.114.97.3, which has not yet been flagged by any of the 95 security vendors on VirusTotal. Despite the absence of detections, the domain appears in one threat intelligence pulse on AlienVault OTX, suggesting preliminary identification by at least one security community source. The page title, 'Jack in the Box,' further corroborates the impersonation attempt, as it matches the branding of the legitimate corporate site. Current risk assessment categorizes this domain as active and unmitigated, with potential for rapid escalation as awareness spreads. Organizations and individuals are advised to block access to jackinthebox.wiki at the network perimeter and update endpoint protection rules to include this domain. Security teams should monitor for connections to 188.114.97.3 and investigate any user reports of interaction with the site. Users who may have entered credentials are urged to reset passwords immediately and enable multi-factor authentication on all associated accounts. Continuous monitoring of threat intelligence feeds for updates on this domain is recommended to preempt further exploitation.