jandhanyojna[.]org

The domain jandhanyojna.org was registered on January 17, 2026 through Ultahost, Inc. It resolves to the IPv4 address 159.100.6.19, which geolocates to Germany and is hosted by UltaHost Inc. All four authoritative name servers—ns1.ultahost.com through ns4.ultahost.com—are under the same provider, indicating a modest hosting footprint. The site presents an HTTPS service secured by a Let's Encrypt R13 certificate, which suggests a recent but automated deployment of TLS.

Network and reputation data show a mixed but concerning picture. VirusTotal has flagged the domain in 15 of 95 scanned security vendors, and Gridinsoft assigns a trust score of 0 out of 100. Scamadviser rates the domain at 41 out of 100, and the domain appears on a single security blocklist. PhishDestroy actively blocks the domain, and its current status is marked as active. HTTP requests receive a 301 redirect, and the final page title reads "Account Suspended," which may be a placeholder or a deterrent page.

While the observed HTTP response and page title do not directly expose a phishing landing page, the broader intelligence categorizes the activity as an Account Takeover campaign. The presence of a self-referential MX record (priority 0, host jandhanyojna.org) could be used to receive victim communications or to facilitate credential harvesting. However, the exact payload, phishing templates, or victim targeting details remain undocumented, leaving a gap in the operational picture.

Defenders should treat jandhanyojna.org as high‑risk infrastructure. Immediate actions include adding the domain to web proxy and DNS blocklists, monitoring for outbound connections to 159.100.6.19, and inspecting email flows for messages routed through the domain's MX record. Threat hunting should focus on detecting credential‑related anomalies that could indicate an ongoing account takeover attempt. Continuous re‑evaluation is advised as additional indicators may emerge.