jellybeanmeme[.]com

Analysis of jellybeanmeme.com shows a recently registered domain (created 06 Mar 2026) that was actively resolved to the Cloudflare‑owned address 104.21.59.33 in the United States (AS13335). The domain is hosted on Cloudflare’s network and uses the default Cloudflare nameservers clara.ns.cloudflare.com and tom.ns.cloudflare.com. Registration was performed through NiceNIC International Group Co., Limited, a registrar that does not provide additional transparency about the registrant. No TLS certificate is present, indicating that the site either served over plain HTTP or relied on Cloudflare’s automatic HTTPS without a dedicated certificate. The only visible page element is the title “JELLYBEAN”, and no further content has been captured because the service was taken offline prior to detailed inspection.

Threat intelligence indicates that the domain has been classified as a generic phishing site. It appears on three independent blocklists and is actively blocked by the PhishDestroy, MetaMask, and SEAL filtering engines. VirusTotal records show that one out of ninety‑four scanned security vendors flagged the domain, providing an additional independent signal of malicious intent. The combination of a fresh registration, lack of TLS, association with known phishing blocklists, and the presence of a single vendor detection suggests a deliberate attempt to lure victims, even though the exact phishing lure (e.g., credential harvesting or crypto wallet baiting) has not been disclosed.

Uncertainty remains regarding the specific payload or credential‑stealing mechanisms that may have been served, as the site was taken offline before a full page scrape could be performed. No evidence of brand impersonation, malicious binaries, or command‑and‑control infrastructure has been observed.