jitobounty[.]xyz

Analysis of the domain jitobounty.xyz, observed on July 24, 2026, indicates a high‑risk brand‑impersonation infrastructure targeting the cryptocurrency project Jito. The domain was registered on October 01, 2025 through NiceNIC International Group Co., Limited and is served by the authoritative nameservers ns3.my-ndns.com and ns4.my-ndns.com. DNS resolution points to the loopback address 127.0.0.127, a pattern often used after takedown or sink‑hole deployment; the current status is listed as offline, suggesting the hosting has been removed or redirected. No TLS certificate is presented, leaving the site without encryption and making it trivially interceptable. The page title returned by HTTP requests is the literal domain string “jitobounty.xyz”, providing no additional context.

Reputation services flag the domain as malicious. VirusTotal reports that 11 of 95 scanning engines have identified the host as malicious, reinforcing the suspicion of phishing activity. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single external blocklist, where it is actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, indicating a high likelihood of abuse.

The combined evidence aligns with the declared scam type of “Brand Impersonation”. Given the concrete indicators—registered under a known registrar, authoritative nameservers, lack of SSL, low trust score, multiple vendor detections, and explicit blocklist listings—security teams should treat jitobounty.xyz as a malicious host. Recommended actions include adding the domain to network‑level deny lists, updating email filtering rules to block any messages containing the domain, and monitoring for newly registered domains that share the “jito” keyword or similar naming patterns. Continuous vigilance is advised, as threat actors frequently recycle naming conventions after takedown events.