jl[.]ci67[.]com

The domain jl.ci67.com was registered through NameSilo, LLC on 2023-06-08 and is currently resolving to the IP address 104.21.57.164, which is served by Cloudflare as indicated by the authoritative nameservers autumn.ns.cloudflare.com and boyd.ns.cloudflare.com. Google Safe Browsing classifies the domain as a social engineering threat, and three independent blocklists have already listed it as malicious. Additional confirmation comes from blocklist operators PhishDestroy, MetaMask, and SEAL, all of which have actively blocked the domain. VirusTotal reports that the domain has been scanned by 91 antivirus engines without any current detections; however, the absence of a detection does not imply safety and should be interpreted with caution.

Infrastructure analysis shows a typical Cloudflare front‑end, a common choice for phishing operators seeking rapid deployment and DDoS protection. The domain’s age, exceeding three years, suggests it was likely created for long‑term abuse rather than a one‑off test. No public SSL certificate details, HTTP response codes, or page title information are available at this time, leaving the exact content and lure techniques unverified. The lack of visible page metadata means defenders cannot yet confirm whether the site imitates a specific brand or employs credential‑harvesting forms.

Given the combination of a Google Safe Browsing warning, presence on multiple blocklists, and active status, the domain should be treated as high‑risk. Network defenders are advised to block outbound connections to 104.21.57.164, update intrusion‑prevention signatures with the domain name, and monitor DNS queries for lookups to jl.ci67.com. Security teams should also consider adding the domain to internal allow‑list exclusions for email and web filtering solutions to prevent accidental user exposure. Continuous re‑evaluation is recommended, as future scans may reveal additional malicious indicators.