jtx[.]vxf[.]mybluehost[.]me

The domain jtx.vxf.mybluehost.me is actively used in a brand impersonation campaign targeting WordPress users. Registration data shows the domain was created on October 5, 2016 through Domain.com - Network Solutions, LLC, and it continues to resolve to the IPv4 address 50.6.34.31. The IP is assigned to an Oracle Corporation network (AS31898) located in Germany, and the host is identified as a Bluehost server running Apache HTTP Server. The site presents a generic "Welcome — Coming Soon" title and returns an HTTP 302 redirect, indicating that visitors are being forwarded to another location that has not been disclosed in the available evidence. TLS is provided by a Let’s Encrypt R12 certificate, confirming that encrypted connections are available but offering no insight into the underlying content.

Threat intelligence sources have flagged the domain on one security blocklist and it is listed as blocked by PhishDestroy. VirusTotal analysis shows that 7 of 95 scanned security vendors have reported the domain as malicious, reinforcing the suspicion of abusive activity. The Gridinsoft trust score of 0 out of 100 further underscores the low reputation of the infrastructure. Nameserver resolution points to ns1.mybluehost.me and ns2.mybluehost.me, both standard for the hosting provider, suggesting that the attacker is leveraging a legitimate hosting environment to obscure attribution.

From a defensive perspective, the observable indicators—domain registration details, IP address, SSL certificate, HTTP status, and the presence on blocklists—should be incorporated into perimeter controls. Network and endpoint security solutions ought to block connections to 50.6.34.31 and to the fully qualified domain name jtx.vxf.mybluehost.me. URL filtering policies must be updated to flag any HTTP 302 responses originating from this host, and threat‑intelligence feeds should be monitored for any additional domains resolving to the same IP or sharing the same nameservers.