zojusu[.]xyz

This domain, zojusu.xyz, is currently under investigation for generic phishing activity with a focus on impersonating Messenger. Analysis indicates the site presents itself as a legitimate Messenger login portal, likely designed to harvest user credentials or distribute malicious payloads. No specific drainer kit signatures have been identified at this stage, but the domain’s infrastructure aligns with known phishing patterns targeting social media platforms. Technical indicators reveal the domain was registered on June 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3, a host that has been associated with other low-reputation domains in prior threat intelligence reports. VirusTotal reports 0/95 detections, suggesting the domain has not yet been widely flagged by security vendors. Google Safe Browsing (GSB) status is currently unlisted, and the domain appears in only one AlienVault OTX threat intelligence pulse, indicating limited visibility in blocklists. The domain remains active, and no takedown actions have been observed as of this report. Users are advised to treat zojusu.xyz as high-risk and avoid interacting with any content hosted on it. Organizations should consider preemptive blocking of the domain and its associated IP address in network security controls. Continuous monitoring is recommended, as the domain’s low detection rate may change if further malicious activity is confirmed.