jweb-baseiinetmx[.]club

Analysis conducted on July 23, 2026 indicates that the domain jweb-baseiinetmx.club was registered through Dynadot LLC on December 12, 2025. The domain resolves to the IP address 199.59.243.228, which is associated with the Amazon.com, Inc. network (AS16509) located in the United States. No TLS certificate is presented, meaning the site operates over plain HTTP only. The authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net. The page title returned by the server is identical to the domain name, providing no additional context.

Google Safe Browsing classifies the URL as a social engineering threat, and the site appears on a single public blocklist maintained by PhishDestroy. VirusTotal analysis shows that 16 of 95 scanned security vendors flagged the domain, consistent with its identification as a crypto‑related phishing campaign. Gridinsoft’s trust scoring system assigns a score of 0 out of 100, indicating extreme distrust. The observed phishing kit is labeled “Airdrop Scam,” which aligns with the reported crypto scam classification. The current status is taken offline, but the infrastructure may be re‑activated by the threat actor.

Defenders should block jweb-baseiinetmx.club at the DNS and proxy layers, add the resolving IP 199.59.243.228 to network deny lists, and monitor for any future resolution of the domain or its nameservers. Because the site lacks an SSL certificate, HTTP traffic can be inspected without decryption overhead, allowing security appliances to capture any payload if the site returns online. Investigators may consider contacting Dynadot for additional registration details if attribution is required. Continuous re‑scanning with multi‑engine platforms is recommended to detect changes in detection ratios or new malicious content.