jhdqsl[.]com

This domain, jhdqsl.com, has been identified as a credential theft phishing site targeting user login credentials. Analysis indicates the domain is currently offline, though prior activity suggests malicious intent to harvest sensitive authentication data. No specific brand impersonation was confirmed, but the domain exhibits characteristics consistent with credential harvesting operations. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating moderate detection coverage. Registered through Gname.com Pte. Ltd. on May 14, 2020, the domain resolves to the IP address 172.67.149.229, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. The domain appears on two security blocklists, specifically PhishDestroy and PhishingDB, further corroborating its malicious classification. The page title, ERROR 404 - Not Found, suggests either a takedown or temporary deactivation of the phishing content. Current status confirms the domain is offline, reducing immediate risk to end users. However, historical activity and infrastructure indicators warrant continued monitoring. Organizations are advised to block the domain and associated IP (172.67.149.229) at the perimeter firewall and DNS filtering levels. Security teams should review logs for prior connections to this domain or IP, particularly from endpoints exhibiting anomalous authentication attempts. Users should be reminded to verify domain authenticity before entering credentials, especially on sites lacking valid SSL certificates or exhibiting unusual URL structures. Given the domain's age and hosting provider, further investigation into related infrastructure is recommended to identify potential linked threats.