jmper[.]xyz

Analysis of jmper.xyz indicates a high-risk phishing domain targeting users through a deceptive 'Robot Challenge Screen' page title. The domain was registered on March 26, 2026, via Namecheap and currently resolves to 34.175.18.31, a Google Cloud IP address located in Spain. Infrastructure review shows the site uses Nginx as its web server and is protected by a Let's Encrypt SSL certificate, a common setup for both legitimate and malicious sites. Nameservers point to SiteGround, while MX records route through a third-party spam filtering service, suggesting an attempt to appear operational and legitimate. The domain is actively flagged by two security blocklists and is explicitly blocked by PhishDestroy and ScamSniffer. Five of 94 security vendors on VirusTotal detect the domain as malicious, though the specific payload or phishing kit remains unconfirmed. The HTTP response code is 403 (Forbidden), which may indicate the site is either restricting access, undergoing maintenance, or using anti-bot measures to evade detection. No brand impersonation is evident from the available data, and the exact nature of the phishing scheme—beyond the 'Robot Challenge' theme—is not yet analyzed. Defenders should treat jmper.xyz as an active threat. Block the domain at DNS and network levels, monitor for connections to the associated IP (34.175.18.31), and alert users to avoid interaction. If internal logs show traffic to this domain, investigate for credential theft or malware delivery. Further analysis of the site’s content and payload is recommended to determine the full scope of the campaign.