jvp[.]ng

This domain, jvp.ng, was created on 10 September 2025 through OwnRegistrar, Inc. and resolves to the IP address 172.67.212.6, which is hosted by Cloudflare, Inc. (AS13335) in the United States. The site presented a page titled “Wallet · Privy”, indicating an attempt to masquerade as a Privy cryptocurrency wallet service. No TLS certificate was observed; the endpoint served only over HTTP, which is consistent with the low Gridinsoft trust score of 0 out of 100. The domain appears on two independent phishing blocklists, PhishDestroy and ScamSniffer, confirming that security vendors have identified it as malicious.

VirusTotal analysis recorded two positive detections out of ninety‑five scanners, further corroborating its abusive nature. Nameserver records point to ariadne.ns.cloudflare.com and ignacio.ns.cloudflare.com, both Cloudflare‑managed. As of the report date, 25 July 2026, the domain is taken offline, but the historical footprint suggests a short‑lived crypto‑drain campaign targeting users of Privy wallets. Uncertainty remains regarding the full scope of the campaign, such as the number of victims or any additional infrastructure that may have been leveraged.

Defenders should continue to block the domain at DNS and proxy layers, add the associated IP address to deny lists, and monitor for any re‑registration attempts. Further analysis of traffic logs for connections to 172.67.212.6 may reveal residual malicious activity. Continuous re‑evaluation of the two blocklist entries is recommended, as the domain’s status could change if re‑hosted.