jam-protocol[.]io

The domain jam-protocol.io was registered on 2026-03-02 and is currently classified as a generic phishing site with a high risk rating. The site presents a 522 Connection timed out page title, indicating that the hosting service is deliberately delaying or refusing connections, a technique often used to evade automated analysis. Its active status as of 2026-07-12 suggests ongoing malicious activity targeting users who may be directed to the domain through phishing campaigns. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to the United States and is hosted behind Cloudflare’s network (AS13335). The authoritative nameservers are gabe.ns.cloudflare.com and heidi.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site serves HTTP responses with status code 200 over TLS, presenting a Let's Encrypt certificate (issuer E8) and supporting HTTP/3, indicating a modern web stack designed for fast delivery and potential evasion of older inspection tools. Reputation signals are uniformly negative. The Gridinsoft trust score is 0 out of 100, and the domain appears on three independent security blocklists. VirusTotal reports that one out of ninety‑five security vendors has flagged the domain, reinforcing the suspicion despite the low detection count. The page title, SSL certificate, and use of Cloudflare are consistent with other known phishing infrastructure that leverages reputable services to obscure malicious origins. Uncertainties remain regarding the specific phishing payloads or lures delivered through the site, as no content was captured beyond the timeout response. Defenders should treat any traffic to jam-protocol.io as malicious, enforce network‑level blocking, and monitor DNS queries for the associated Cloudflare nameservers. Continuous re‑evaluation is advised, given the domain’s recent creation and active status, to detect any shifts in payload or targeting tactics.