tjg-rju-edi-zjw-org-rfj-cfu[.]netlify[.]app

This domain, tjg-rju-edi-zjw-org-rfj-cfu.netlify.app, was registered on May 09, 2018 through Netlify and resolves to the Amazon‑owned address 98.84.224.111 (AS14618, United States). The hosting infrastructure is identified as Netlify, and the site serves an SSL certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, indicating a valid TLS configuration. The site returned an HTTP 404 status at the time of analysis, and the page title observed was “Connect & Unlock”, a generic phrasing often used in credential‑harvesting campaigns. Technology fingerprints include Netlify and HTTP Strict Transport Security (HSTS), suggesting the site was intended to enforce secure connections.

VirusTotal recorded 15 detections out of 93 scanning engines, and the domain appears on a single external blocklist, where it was flagged by PhishDestroy. No additional public threat‑intel sources such as OTX or Safe Browsing entries were cited. The domain is currently offline, which may indicate that the malicious campaign has been taken down or is temporarily inactive.

Defenders should continue to monitor for any resurgence of the same host or IP address, especially since the IP belongs to a cloud provider that may host unrelated legitimate services. Blocking the domain at perimeter filters, updating URL reputation lists with the observed detections, and correlating any internal logs that reference the “Connect & Unlock” title or the specific IP address can help contain potential abuse. Because the site’s content could not be retrieved, analysts should treat the observed indicators as provisional and verify any future activity against the same infrastructure before assigning a final risk rating.