ronald22lancha[.]github[.]io

The domain ronald22lancha.github.io is currently flagged as a brand‑impersonation site targeting the cryptocurrency service Jito. Technical analysis shows the domain resolves to the IPv4 address 185.199.111.153, which belongs to Fastly, Inc. (AS54113) and is geolocated in the United States. The hosting infrastructure is identified as GitHub Pages fronted by Fastly’s CDN, with Varnish caching observed in the service stack. The site presents a TLS certificate issued by Let’s Encrypt (R12) that is valid for the domain, indicating that encryption is correctly configured despite the malicious intent.

An HTTP request to the root path returns a 404 status code, suggesting that the malicious page is either removed or never served content at the queried URL. The page title returned by the server is "ojito," which does not match the legitimate Jito branding and may be an attempt to obscure the target. The domain appears on a single security blocklist, PhishDestroy, and VirusTotal reports that 13 of 95 scanning engines have flagged the domain as malicious, reinforcing the suspicion of abuse. Registration information shows the domain was created through GitHub, Inc., a common vector for abuse of free hosting services.

The current status is listed as offline, but the presence on blocklists and the detection count indicate that the domain was previously used for brand‑impersonation activity. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the IP address 185.199.111.153, and consider adding the domain to internal blacklists even though the site is presently inactive. Additional investigation is warranted to determine whether other subdomains or related GitHub Pages sites are being leveraged for similar campaigns targeting Jito or other financial services.