jobyweeks[.]info

The domain jobyweeks.info was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on 27 July 2026. Its authoritative name servers are jihoon.ns.cloudflare.com and tara.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. DNS resolution points to the IPv4 address 188.114.97.3, a host that currently appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal records show that the domain was submitted for analysis and inspected by 91 independent scanning engines; none of those engines raised a detection at the time of review.

While the lack of detections does not constitute evidence of benign behavior, it demonstrates that the domain has not yet been flagged by mainstream malware scanners. The combination of recent registration, Cloudflare‑based name resolution, and presence on a phishing‑focused blocklist aligns with patterns commonly observed in short‑lived phishing infrastructure. The domain’s activity status is listed as active, and no additional public intelligence—such as SSL certificate details, HTTP response codes, or page‑title metadata—has been disclosed. Consequently, the confidence level regarding its malicious intent rests primarily on its registration profile and the fact that it has been identified and blocked by PhishDestroy.

Defenders should add 188.114.97.3 and the host name jobyweeks.info to network‑level deny lists, monitor DNS queries for the domain, and enforce web‑filtering policies that reference the known blocklist entry. Continuous re‑scanning on VirusTotal or comparable platforms is advisable to capture any future changes in detection status. Given the domain’s recent creation and active classification, proactive blocking is recommended to mitigate potential credential‑harvesting attempts.