jellychain[.]sbs

This domain, jellychain.sbs, is currently flagged as an active phishing threat targeting cryptocurrency wallet users. Analysis indicates the domain was registered on April 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains operational as of July 12, 2026. Security vendors have detected malicious activity, with 7 out of 95 engines on VirusTotal identifying the domain as harmful. The site resolves to 104.21.82.132, an address hosted by Cloudflare in Canada, and presents a 403 HTTP status, suggesting access restrictions or backend protective measures to evade automated scans. Infrastructure analysis reveals the domain uses Cloudflare nameservers, specifically june.ns.cloudflare.com and nikon.ns.cloudflare.com, a common tactic to obscure hosting details and improve resilience against takedowns. The SSL certificate is issued by Let's Encrypt, a legitimate provider often exploited by threat actors to appear trustworthy. While the domain is blocked by multiple security blocklists, including PhishDestroy, MetaMask, and SEAL, its continued resolution and active status indicate ongoing abuse. Defenders should note that the domain appears on three distinct security blocklists, reinforcing its classification as a high-risk threat. The 403 status may indicate the site is selectively serving content to targeted users or regions, complicating detection and analysis. Organizations are advised to block the domain and its associated IP at the network level, monitor for connections to 104.21.82.132, and alert users to potential wallet credential theft attempts linked to this infrastructure. No specific phishing kit or targeted brand has been confirmed, but the domain's naming convention and blocklist associations strongly suggest cryptocurrency-related fraud.