dnsjumper[.]app

This domain, dnsjumper.app, is flagged as a high-risk phishing site designed to impersonate legitimate network utility tools. Analysis indicates the site mimics DNS management software interfaces, likely targeting IT professionals and network administrators to harvest credentials or distribute malicious payloads. No direct association with known crypto drainer kits or brand-specific impersonation (e.g., Microsoft, Google) has been observed, but the generic phishing framework suggests broad targeting for credential theft or malware deployment. Infrastructure analysis reveals the domain was registered on October 23, 2025, through Spaceship, Inc., and currently resolves to the IP address 104.21.17.26. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist (Maltrail). The domain uses a Let's Encrypt SSL certificate, which provides HTTPS encryption but does not validate legitimacy. Google Safe Browsing (GSB) status remains unconfirmed, and no additional blocklists beyond Maltrail have been identified at this time. The domain remains active as of the latest verification, with no takedown or sinkholing observed. Response actions should include immediate blocking at the DNS or proxy level, particularly in enterprise environments where network utilities are frequently used. Remaining risk is classified as high due to the domain's recent registration, low detection coverage, and potential for credential harvesting or secondary payload delivery. Network administrators are advised to monitor for unusual outbound connections to 104.21.17.26 and audit any recent access to dnsjumper.app in logs. End users should be cautioned against downloading software or entering credentials on the site, even if it appears to offer legitimate functionality.