Analysis of the domain jitochain.live indicates it is an active phishing infrastructure targeting cryptocurrency users, first observed on July 28, 2026. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It currently resolves to IP address 188.114.97.3 and uses Cloudflare nameservers (dolly.ns.cloudflare.com and jaziel.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. As of July 31, 2026, the domain appears on one security blocklist and is blocked by PhishDestroy, though it has not been flagged by any of the 91 vendors in the most recent VirusTotal scan.
The absence of detections in VirusTotal does not confirm legitimacy, particularly given the domain's recent registration and presence on other blocklists. Infrastructure analysis reveals no additional brand-specific indicators or page content details, as the exact nature of the phishing scheme remains unconfirmed. Defenders should treat this domain as high-risk due to its recent creation, Cloudflare proxy usage, and blocklist inclusion.
Network-level blocking is recommended, along with monitoring for related domains registered through the same registrar or resolving to the same IP. Further investigation is required to determine the specific phishing kit, target audience, or cryptocurrency services being impersonated. No evidence currently links this domain to a known phishing campaign or threat actor group.