js2026air[.]live

This domain, js2026air.live, is currently under investigation for credential harvesting phishing activity. Analysis indicates it is designed to impersonate legitimate services, tricking users into submitting login credentials, payment details, or other sensitive information. The threat type is classified as generic_phishing, with a focus on broad targeting rather than a specific organization or sector. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3 and was registered on January 12, 2026, through Global Domain Group LLC. Despite its recent creation, the domain remains undetected on VirusTotal, with 0/95 security vendors flagging it as malicious. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Additional trust metrics, such as a Gridinsoft trust score of 0/100, further suggest suspicious activity. No blocklist entries have been recorded yet, but the domain’s active status and lack of prior reputation raise concerns. Mitigation steps for this threat include blocking the domain and its associated IP address (188.114.97.3) at the network perimeter. Organizations should monitor for connections to this domain in logs and alert users who may have interacted with it. Endpoint protection solutions should be updated to include this domain in phishing detection rules, and security teams should conduct retrospective analysis to identify any prior exposure. Users should be educated on recognizing phishing attempts, particularly those leveraging newly registered domains with valid SSL certificates. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended.