jtexpress-su[.]top

Analysis conducted on August 02, 2026, identifies jtexpress-su.top as an active phishing domain designed to impersonate J&T Express, a known logistics and courier service. The domain is currently flagged for social engineering by Google Safe Browsing and appears on at least one security blocklist, with PhishDestroy having implemented a block. Despite being scanned by 91 vendors on VirusTotal, no detections were recorded at the time of analysis; however, the absence of detections does not confirm the domain's legitimacy, particularly given its presence on other security lists. Infrastructure analysis reveals the domain was registered through a privacy-protected registrar, obscuring ownership details.

The exact hosting provider and IP address remain unconfirmed in the available intelligence, limiting attribution efforts. The domain's structure, incorporating 'jtexpress' alongside a non-standard suffix ('su.top'), aligns with tactics observed in courier-themed phishing campaigns, where attackers exploit brand recognition to deceive victims into disclosing personal or financial information. Defenders are advised to treat this domain as malicious and implement blocking measures at the network and endpoint levels.

Organizations should monitor for any connections to jtexpress-su.top in logs, particularly those associated with email or SMS-based phishing attempts. Given the domain's active status and confirmed social engineering classification, further investigation into its hosting infrastructure and associated threat actors is recommended. No evidence of a phishing kit or specific page content has been analysed at this stage, leaving the exact mechanics of the scam unverified.