jnwhcy[.]com

This domain is actively conducting phishing operations targeting cryptocurrency users by masquerading as a legitimate wallet service. Analysis indicates the infrastructure is designed to harvest login credentials, private keys, and recovery phrases through deceptive interfaces that closely mimic authentic platforms. The threat specifically exploits users attempting to access or recover digital assets, redirecting them to fraudulent input forms that transmit sensitive data to attacker-controlled servers. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain jnwhcy.com is registered through West263 International Limited and currently resolves to the IP address 91.110.224.20. Security vendors on VirusTotal have flagged this domain at a ratio of 4/95, with detection signatures identifying it as a phishing endpoint. The domain appears on three distinct security blocklists, including those specializing in financial fraud prevention. The SSL certificate, issued by Let's Encrypt (serial number YE2), does not mitigate the risk, as phishing domains frequently use valid certificates to appear legitimate. Users who have visited jnwhcy.com or entered any information on the site should immediately take corrective actions. First, revoke any permissions granted to the domain in wallet applications or browser extensions. Second, transfer all digital assets to a new wallet with a fresh seed phrase, as private keys may have been compromised. Third, monitor all linked accounts for unauthorized transactions and enable additional authentication factors where available. If financial losses have occurred, report the incident to relevant authorities and provide them with the domain, IP address, and any transaction hashes associated with the fraudulent activity.