justori-devancais.com — Fake Exchange Phishing Report

The domain justori-devancais.com was registered on March 16, 2026 through the registrar NETIM. DNS resolution points to the IPv4 address 217.60.38.33, which is assigned to a hosting provider identified as Adcdata Limited in Hong Kong. The authoritative nameservers listed for the zone are ns1.rt78u9.com and ns3.pl9vr3.com, both of which are not associated with the registrar and suggest the use of third‑party DNS services.

A request to the site returns HTTP status 200 and serves a landing page titled “Justòri Devançais | Plateforme de trading alimentée par l'IA – Site officiel”. The page is delivered over TLS using a Let’s Encrypt certificate (R12) and is built with Nginx as the web server and Unpkg as a front‑end asset delivery component. The content mimics a legitimate trading platform, positioning itself as an AI‑powered exchange, which aligns with the classification of a fake exchange phishing operation.

VirusTotal scans have flagged the domain in 14 of 95 security vendor checks, and the site appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious nature of the infrastructure. The risk level is marked as high and the status remains active, indicating that the site is still reachable and likely being used to harvest credentials from unsuspecting victims.

While the observed infrastructure confirms a high‑confidence phishing campaign, details such as the specific credential harvesting mechanism, the backend data exfiltration path, and any associated command‑and‑control servers have not been disclosed publicly. Analysts should monitor DNS changes for the domain and its nameservers, enforce blocklisting of the IP address 217.60.38.33, and consider adding the domain to internal email and web filtering policies. Continuous threat‑intel feeds should be consulted for any emerging indicators tied to this infrastructure.