jabame[.]xyz

The domain jabame.xyz is identified as a high-risk generic phishing site currently active and targeting users through impersonation of the Messenger platform. Analysis indicates the site is designed to harvest login credentials by presenting a fraudulent authentication interface, as evidenced by its page title labeled 'Messenger.' The domain poses an immediate threat to users who may unknowingly submit sensitive account information, leading to unauthorized access or further malicious exploitation. Infrastructure analysis reveals the domain was registered on June 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive domains. It resolves to the IP address 188.114.96.3, which has been linked to other phishing campaigns in recent threat intelligence feeds. The domain is flagged by 15 of 95 security vendors on VirusTotal, appears on one security blocklist, and was documented in a single AlienVault OTX threat intelligence pulse. Despite these indicators, the site remains operational and accessible, suggesting limited detection coverage across common security controls. Current risk assessment categorizes jabame.xyz as high due to its active status, low detection rate, and direct targeting of user credentials. Organizations and individuals are advised to block the domain at the DNS or proxy level, update endpoint protection rules to include this indicator, and monitor network logs for connections to 188.114.96.3. Users should be alerted to avoid interacting with the site and report any suspicious login prompts resembling Messenger. Security teams are recommended to correlate this domain with other known phishing infrastructure and review authentication logs for potential compromise.