dnsjumper[.]io

Analysis of dnsjumper.io indicates an active credential‑phishing infrastructure targeting Windows users seeking DNS utilities. The domain resolves to the IPv4 address 62.171.140.208, which is hosted in France and assigned to AS51167 operated by Contabo GmbH. Registration records show the domain was created on 9 October 2025 through ENOM, INC., and the authoritative name servers are ns1.dreamhost.com, ns2.dreamhost.com, and ns3.dreamhost.com. The web server presents an HTTP 200 response, uses Nginx with HSTS enabled, and serves content signed by a Let’s Encrypt certificate (YR2). Page metadata reveals the title “Download DNS Jumper v2.3 Free – Best DNS Changer for Windows | Speed Up Internet”, and the site loads Tailwind CSS and Google Analytics, suggesting a typical commercial‑style landing page. Threat intelligence flags the domain as a credential‑phishing site. VirusTotal scans show 19 of 91 security vendors flagged the domain, and the host appears on three public blocklists. AlienVault OTX lists the domain in two separate threat pulses. Additional blocklist coverage includes PhishDestroy, MetaMask, and SEAL. The observed techniques—use of a reputable SSL certificate, HSTS, and common web frameworks—are consistent with attempts to gain user trust. Uncertainty remains regarding the exact phishing workflow, payload delivery mechanisms, and any compromised credentials harvested. No public samples of the phishing page or malicious binaries have been released, and the specific target brand beyond the generic “DNS Jumper” reference is not confirmed. Defenders should block DNS resolution to 62.171.140.208, add dnsjumper.io to URL filtering and email security policies, and monitor for outbound connections to the identified IP range. Network sensors should flag TLS traffic to the Let’s Encrypt certificate associated with the domain.