jj1505[.]com

This domain, jj1505.com, is classified as an elevated-risk credential harvesting phishing site designed to deceive users into disclosing sensitive authentication credentials. Analysis indicates the infrastructure was specifically engineered for phishing operations, targeting login credentials through fraudulent web forms mimicking legitimate services. The threat type is categorized as generic_phishing, with a focus on credential theft rather than malware distribution or exploit delivery. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 27, 2019, and resolves to the IP address 103.143.28.213, located in Hong Kong under autonomous system AS135581 (ONL-HK). Detection metrics show 21 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on two distinct security blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued to a generic entity, Default Company Ltd, a common indicator of low-effort or automated phishing setups. The domain has since been taken offline, though residual risk remains for systems that may have cached or stored the malicious resolution. Mitigation measures should prioritize credential security and infrastructure hardening. Organizations are advised to block the domain and its associated IP (103.143.28.213) at the perimeter firewall and DNS filtering layers. Endpoint protection systems should be updated to include the domain in phishing detection rules, while security teams should review logs for any prior connections to the IP or domain. Users who may have interacted with the site should be instructed to reset credentials on any accounts accessed during the exposure window, with multi-factor authentication enabled where possible. Network administrators should monitor for anomalous outbound traffic to the IP range 103.143.28.0/24, as related infrastructure may still pose a residual threat.