js36644[.]com

The domain js36644.com has been identified as a generic phishing infrastructure, currently classified under investigation for its potential involvement in fraudulent activities. Analysis does not indicate a specific brand impersonation at this stage, but the domain aligns with patterns observed in broad-spectrum phishing campaigns designed to harvest credentials or distribute malicious payloads. The domain is presently offline, though prior activity remains under scrutiny. Infrastructure analysis reveals that js36644.com was registered on May 19, 2026, through NameSilo, LLC, a registrar frequently observed in low-reputation domain registrations. The domain resolves to the IP address 168.76.227.175, which has been associated with other suspicious endpoints in recent threat intelligence reports. Detection metrics indicate that the domain has not been flagged by any of the 95 vendors monitored via VirusTotal, though it appears in two threat intelligence pulses on AlienVault OTX. Additionally, the domain is listed on one security blocklist, specifically PhishDestroy, suggesting prior malicious classification. At present, js36644.com remains inactive, though its historical associations warrant continued monitoring. Organizations are advised to implement proactive measures, including blocking the domain and its resolving IP address at the network perimeter. Security teams should review logs for prior connections to 168.76.227.175 or interactions with js36644.com, particularly in contexts involving credential submission or file downloads. Given the domain's recent creation and limited detection history, heightened vigilance is recommended for any future reactivation or related infrastructure.