jito-rewards[.]network

jito-rewards.network was observed on July 24, 2026 with the HTTP response indicating a Plesk Obsidian 18.0.71 control panel page. The site was taken offline at the time of analysis, but the underlying infrastructure remains visible. The domain resolves to the Cloudflare edge address 104.21.38.10, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. Nameservers harlan.ns.cloudflare.com and nena.ns.cloudflare.com confirm that the domain is fully proxied through Cloudflare, a common choice for fast‑flux and abuse campaigns. No TLS certificate was presented, meaning HTTPS was not enforced, which further reduces the credibility of the service. The page title and the declared scam type “Fake Airdrop” indicate that the operator attempted to impersonate the legitimate Jito brand, likely to lure cryptocurrency users into submitting private keys or wallet credentials.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of trust. The domain appears on two independent security blocklists and is actively blocked by PhishDestroy and ScamSniffer. VirusTotal scans show that five of ninety‑five antivirus and URL‑reputation engines flagged the domain as malicious, providing additional corroboration of its abusive nature. Registration data shows the domain was created through Cloudflare, Inc., a registrar that often masks registrant details, making attribution difficult. The absence of a valid SSL certificate and the use of a generic Plesk control panel page are consistent with a low‑effort fraudulent operation rather than a sophisticated phishing infrastructure.

However, the use of Cloudflare’s network gives the operator the ability to rapidly relocate the service if needed, so the threat may reappear under a different sub‑domain or IP. Defenders should add 104.21.38.10 to network‑level blocklists, enforce domain‑level deny rules for jito-rewards.