onchainjito[.]xyz

Analysis of onchainjito.xyz as of July 24, 2026 indicates a high‑risk brand‑impersonation campaign targeting the Jito ecosystem. The domain was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolves to the IPv4 address 134.122.194.243, which belongs to AS152194 operated by CTG Server Limited in Japan. The web server returns an HTTP 200 response and delivers a page whose title is “Token Mining”. Detected technologies include PHP, the Nginx web server and HTTP Strict Transport Security (HSTS).

TLS is provided by a Let’s Encrypt certificate (R12) that is currently valid. VirusTotal scans have recorded four positive detections out of ninety‑three AV engines, confirming that multiple security products flag the host as malicious. The domain appears on a single public blocklist and is already blocked by the PhishDestroy feed, reinforcing the malicious classification. No additional public intelligence such as Safe Browsing, Open Threat Exchange, or further vendor reports is available at this time, and the site’s content beyond the page title has not been publicly disclosed, leaving the exact user‑interaction flow uncertain.

Given the combination of recent registration, active hosting, brand‑impersonation intent, and multiple vendor detections, defenders should treat onchainjito.xyz as a confirmed malicious indicator. Recommended mitigation steps include adding the domain and its resolving IP to network‑level deny lists, monitoring DNS queries for the associated nameservers (a4.share-dns.com, b4.share-dns.net), and ensuring endpoint protection solutions are updated to reflect the observed detections. Continuous observation of any changes to the certificate, hosting infrastructure, or additional blocklist listings is advised to maintain situational awareness.