jitosol[.]app

Analysis of the domain jitosol.app, observed on July 24, 2026, indicates a brand‑impersonation campaign targeting the cryptocurrency service Jito. The site was hosted behind Cloudflare’s network, using the authoritative nameservers aryanna.ns.cloudflare.com and greg.ns.cloudflare.com, and resolved to the IP address 172.67.197.252, which is registered to AS13335 Cloudflare, Inc. in the United States. No TLS certificate was presented, and the HTTP response returned the generic page title “Just a moment…”, typical of Cloudflare’s interstitial page. Registration information shows the domain was provisioned through Cloudflare, Inc., without a separate registrar listed.

The domain appears on a single security blocklist and has been flagged by PhishDestroy as malicious. VirusTotal scans reported five of ninety‑five security vendors marking the domain as suspicious, demonstrating limited but notable detection across the threat‑intel ecosystem. The risk level has been assessed as elevated, and the current operational status is offline, suggesting the actors have taken the site down or are rotating infrastructure. Observed evidence confirms the use of Cloudflare’s edge infrastructure to conceal the origin of the malicious host, while the absence of a valid SSL certificate and the presence of a default page title provide minimal visible cues to end users.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no content beyond the interstitial title has been captured. Defenders should block the IP address 172.67.197.252 and the fully qualified domain name jitosol.app at perimeter firewalls and DNS resolvers, add the domain to internal blocklists, and monitor for future re‑registration attempts. Continuous scrutiny of Cloudflare‑hosted domains that resolve to the same IP range is recommended, as adversaries frequently reuse this infrastructure for new phishing or crypto‑scam campaigns.