jpvf[.]xin

PhishDestroy identifies the domain jpvf.xin as an active participant in a generic phishing campaign, currently under investigation by the SOC team. This domain is suspected of mimicking legitimate login portals to harvest user credentials, though no specific brand has been confirmed at this stage. The campaign is assessed as active and evolving, warranting heightened monitoring and containment measures. jpvf.xin remains unflagged by the broader security community, with 0 detections out of 95 VirusTotal vendors as of this advisory. The domain is registered through GNAME.COM PTE. LTD., resolves to the IP address 188.114.97.3, and operates under a valid Let's Encrypt SSL certificate. The domain was created on April 01, 2026, indicating its recent establishment and low historical reputation. No indicators of prior blocklisting or trust score degradation have been observed at this time. Given the active status and lack of community detection, jpvf.xin presents a latent risk to users who may encounter it through phishing emails, malicious ads, or typosquatting. The SOC recommends flagging this domain in DNS and proxy filters, blocking its IP address (188.114.97.3), and revoking its SSL certificate if technically feasible. Users should exercise extreme caution when accessing unsolicited links, verify domain authenticity, and report any suspicious interactions to the SOC team immediately. Further intelligence will be disseminated as the investigation progresses.