b9c17fd5[.]host[.]njalla[.]net

Analysis of b9c17fd5.host.njalla.net shows a newly created infrastructure used for an investment‑type phishing campaign. The domain was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on the IPv6 address 2a0a:3840:1337:127:0:b9c1:7fd5:1337, which resolves to a server located in Denmark under ASN 39287 (Materialism s.r.l.). No SSL certificate is presented, leaving the site exposed to network‑level eavesdropping. The site’s sole observable attribute is the page title “AML Check – The full‑fledged crypto compliance solution,” a phrasing often employed to lure victims interested in cryptocurrency compliance or investment opportunities.

VirusTotal records indicate that 8 of 93 security vendors have flagged the domain, demonstrating moderate detection across multiple engines. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. Nameservers are “1‑you.njalla.no,” “2‑can.njalla.in,” and “3‑get.njalla.fo,” consistent with the njalla.net hosting environment. Current status is offline, but the infrastructure remains observable.

Defenders should continue to monitor the IPv6 address and associated ASN for any re‑activation, enforce blocklist updates to include this host, and ensure that any inbound traffic to the listed nameservers is denied. Absence of TLS underscores the importance of network‑level controls, as any attempt to retrieve content would be unencrypted. Given the investment‑scam classification and the AML‑related page title, security teams should alert users about potential credential‑ harvesting attempts that masquerade as compliance checks and reinforce user education regarding unsolicited crypto‑related requests.