oj[.]jo

This domain, oj.jo, poses a high-risk credential theft threat designed to trick visitors into entering sensitive login information on a fraudulent site. The site impersonates a legitimate brand or service, using deceptive design to capture usernames, passwords, and potentially financial details. Infrastructure analysis shows it is actively hosted and configured to appear trustworthy, with a Let's Encrypt SSL certificate providing a false sense of security. Users who encounter this site should treat it as malicious and avoid any interaction.

Technical indicators confirm the threat level. VirusTotal reports 9 out of 95 security vendors flagging this domain as malicious, a strong signal of its hostile nature. The domain resolves to IP address 192.250.239.61 and uses technologies such as LiteSpeed, jQuery UI, jQuery, and HTTP/3. The SSL certificate from Let's Encrypt is a common choice for phishing sites due to its free and automated issuance. The domain remains active, increasing the urgency for users to exercise caution.

If you have visited oj.jo and entered any credentials or personal data, take immediate action. Change passwords for the affected accounts and any other accounts using the same credentials. Enable two-factor authentication where available. Monitor financial accounts for unauthorized activity and consider running a security scan on your device. Report the domain to relevant authorities or security platforms to help protect others. Avoid revisiting the site and ensure your browser and security software are up to date.