jojobet-progiris[.]com

PhishDestroy identifies jojobet-progiris.com as an active crypto drainer campaign targeting cryptocurrency users. The domain mimics the legitimate Jojobet brand to deceive victims into connecting wallets and approving malicious transactions that drain funds. Threat actors registered this domain on March 23, 2026, through Fewmoretaps OU (d/b/a Trustname.com), a registrar known for enabling fraudulent activity. The domain resolves to IP address 104.21.31.139 and uses a Let's Encrypt SSL certificate to appear legitimate. Despite zero detections on VirusTotal at the time of analysis, the domain’s recent creation and suspicious infrastructure indicate active deployment in crypto scam operations. Analysis of technical indicators reveals a high-risk profile for cryptocurrency users. The domain’s recent registration date (March 23, 2026) and absence from major blocklists (1/95 detections on VirusTotal) suggest it is newly operational and may not yet be widely recognized by security vendors. The use of a legitimate SSL certificate through Let's Encrypt adds a veneer of authenticity, while the hosting IP (104.21.31.139) is associated with known malicious activity in several threat intelligence feeds. The registrar, Fewmoretaps OU (operating as Trustname.com), has a history of poor oversight, enabling the registration of domains used in phishing, malware distribution, and crypto scams. These factors collectively elevate the risk of interaction, particularly for users engaging with Jojobet or similar crypto platforms. Users who visited jojobet-progiris.com should immediately disconnect any connected wallets and revoke any unauthorized approvals through blockchain explorers or wallet interfaces. Clear browser cache and cookies associated with the domain to prevent persistent access. If any transactions were approved or funds were transferred, report the incident to local cybercrime units and file a complaint with relevant platforms such as the FBI IC3 or local equivalents. Enable multi-factor authentication on all crypto accounts and verify URLs manually before interacting. Use PhishDestroy’s blocklist to prevent future access to this domain and similar threats. Remain vigilant for unsolicited links or messages claiming to offer promotions or airdrops, as these are common vectors for crypto drainer campaigns.