jobwyseltd[.]com

This domain, jobwyseltd.com, is currently under investigation for credential harvesting phishing activity targeting job seekers. The site impersonates legitimate recruitment services, presenting itself as Jobwyse Ltd to deceive users into submitting sensitive personal and employment information. As of the latest assessment, the domain remains active and operational, posing an ongoing threat to individuals and organizations. Infrastructure analysis reveals several concerning indicators. The domain resolves to IP address 163.61.188.7 and was registered on October 24, 2024, through Web Commerce Communications Limited dba WebNic.cc. Despite its recent creation and suspicious nature, the domain has not been flagged by any of the 95 vendors on VirusTotal, indicating potential evasion of automated detection systems. The site employs a Let's Encrypt SSL certificate, which while providing encryption, is commonly used by malicious actors to lend a false sense of legitimacy. No blocklist entries or trust score downgrades have been recorded at this time, further complicating detection efforts. Current status remains active with no confirmed takedown or mitigation measures in place. Organizations and individuals are advised to implement immediate network-level blocking of the domain and its associated IP address. Security teams should monitor for inbound or outbound connections to jobwyseltd.com and conduct retrospective analysis of logs for any prior interactions. Users who may have engaged with the site should be instructed to reset credentials on any accounts where similar passwords were used. Given the domain's recent registration and lack of detection flags, heightened vigilance and proactive threat hunting are recommended to identify potential compromise or lateral movement within affected environments.