shoujunffm[.]com

PhishDestroy identifies that the domain shoujunffm.com is actively hosting fake login phishing content, targeting unsuspecting users with fraudulent credential harvesting pages. This domain does not appear to impersonate a specific high-profile brand but instead uses a generic yet deceptive web layout to trick visitors into entering sensitive login information. No known drainer kit signature has been associated with this domain in open threat repositories, suggesting the threat actor may be using a custom or newly deployed toolkit.

Technical indicators reveal that shoujunffm.com was registered through Gname.com Pte. Ltd. on December 14, 2018, and currently resolves to the IP address 154.89.85.206. VirusTotal analysis shows a 19/95 detection rate, indicating no immediate recognition by antivirus engines as of the latest scan. Additionally, this domain is listed on 2 security blocklists and is actively blocked by both OpenPhish and PhishingArmy feeds, confirming its malicious classification. The domain has not yet been flagged by Google Safe Browsing (GSB), which may indicate a window of opportunity for attackers to propagate the link before widespread detection.

This domain remains in an active state and is under investigation by PhishDestroy’s threat intelligence team. Immediate response actions include maintaining network-level blocking via OpenPhish and PhishingArmy feeds and monitoring for any new detections from VirusTotal or GSB. Despite current blocklist coverage, the remaining risk is assessed as moderate due to the 19/95 VirusTotal score and the absence of GSB categorization, which could allow the domain to persist in some environments. Organizations and users are strongly advised to block shoujunffm.com at the DNS and firewall levels and to avoid interacting with any login prompts originating from this domain.