spiritualjanitor[.]com

The domain spiritualjanitor.com was registered on July 03, 2024 through Porkbun LLC and is currently taken offline. DNS resolution points to the IPv6 address 2606:4700:4402::6812:29af, which belongs to Cloudflare’s AS13335 network in the United States. The authoritative name servers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador.ns.porkbun.com. An SSL certificate issued by Let’s Encrypt (R13) is present, confirming that TLS is active but does not attest to the legitimacy of the content. HTTP requests return a 200 status code and the page title observed is "Calendly - J.J.

Bitters", suggesting the site may have been used to host a Calendly‑style scheduling page, though the exact content has not been captured. Technical fingerprints reveal the presence of Apple iCloud Mail, Ruby on Rails, Google Sign‑in, Stripe, Salesforce Marketing Cloud Account Engagement, reCAPTCHA, HubSpot, and generic Ruby libraries, indicating a stack capable of handling user authentication, payment processing, and marketing automation. The domain appears on two public blocklists—PhishDestroy and ScamSniffer—and is listed in one AlienVault OTX pulse, reflecting community‑wide awareness of malicious use. VirusTotal scans show six of ninety‑five security vendors flagging the domain, reinforcing the suspicion of abuse.

Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. While the observed infrastructure points to a typical generic phishing deployment, the exact phishing campaign details (e.g., targeted brand, lure, or credential‑harvesting page) remain unknown because the site content was not examined before takedown. Defenders should continue to block the domain at network perimeter devices, enforce DNS sinkholing for the identified IPv6 address, and monitor for any newly registered domains using the same Porkbun name servers or similar technology stacks.