jymper[.]xyz

This domain, jymper.xyz, is actively serving a phishing page impersonating the Jumper cryptocurrency wallet platform. Analysis indicates the site presents itself as 'Jumper | Smart App for the Universal Market,' a direct mimic of the legitimate service's branding and messaging. The domain was registered on March 26, 2026, through Namecheap and currently resolves to 34.175.18.31, hosted on Google Cloud infrastructure in Spain. Nameservers point to SiteGround, a common hosting provider that may facilitate rapid deployment of fraudulent sites. Technical indicators confirm malicious intent. The domain appears on two security blocklists and is flagged by at least two major threat intelligence platforms, including a pulse in AlienVault OTX. While only 2 out of 95 security vendors on VirusTotal currently detect this domain, this low detection rate does not imply safety; phishing domains often evade initial scans through obfuscation or delayed detection. The site returns an HTTP 403 status, which may indicate restricted access or cloaking techniques designed to evade automated crawlers while remaining accessible to targeted victims. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate, which provides HTTPS encryption but does not validate the legitimacy of the site. The domain's trust score is 0 out of 100, reinforcing its classification as high-risk. Defenders should treat this domain as a confirmed phishing threat, particularly targeting users of cryptocurrency wallets. Network-level blocking is recommended, and security teams should monitor for related domains using similar naming conventions or infrastructure patterns. Given the domain's active status and continued hosting, further malicious activity is likely.