018uh[.]mjt[.]lu

The domain 018uh.mjt.lu has been identified as an active generic_phishing infrastructure. It is currently serving HTTP 200 responses and presents a TLS certificate issued by DigiCert Inc, specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain. The certificate is valid and was signed by a widely trusted root, indicating an effort to appear legitimate.

Network observations show the domain resolves to the IPv4 address 35.241.186.140, which is allocated to AS396982 owned by Google LLC and geolocated to Belgium. The authoritative name servers are ns0.mljt.tech, ns1.mljt.tech, and ns2.mljt.tech, suggesting the operator uses a separate DNS hosting service. Registration records indicate the domain was created through OVH, a provider known for offering rapid registration services.

Reputation signals are strongly negative. The domain appears on two security blocklists, PhishDestroy and PhishingDB, and has a Gridinsoft trust score of 0 out of 100. VirusTotal analysis reports six out of ninety‑five security vendors flagging the domain, reinforcing the suspicion that the site hosts malicious content. The page title returned by the server is “Technical subdomain”, and no further content analysis is available at this time.

Defenders should treat 018uh.mjt.lu as a high‑risk phishing host. Immediate mitigation steps include adding the domain to outbound and inbound filtering rules, updating DNS blocklists, and monitoring for any traffic to the associated IP address. Continuous observation of the supporting name servers and the OVH registration details is advised, as changes may indicate campaign evolution. Incident response teams should also consider sinkholing the IP if feasible and sharing indicators of compromise with threat‑sharing communities.