vote-jito[.]network

Analysis of vote-jito.network indicates a brand impersonation campaign targeting Jito, a liquid staking protocol for Solana. The domain was registered on March 13, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to IP 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335). No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'Jito MEV Harvesting | Harvest Liquid Staked SOL - Maximise your Revenue,' explicitly references Jito’s MEV (Maximal Extractable Value) harvesting services, suggesting an attempt to deceive users into engaging with fraudulent staking or revenue-maximization offers. The domain appears on a single security blocklist, PhishDestroy, and was flagged by 1 of 95 security vendors on VirusTotal, indicating limited but confirmed detection.

Technologies detected include Cloudflare Browser Insights and HTTP/3, consistent with Cloudflare-hosted infrastructure. Nameservers emily.ns.cloudflare.com and vicente.ns.cloudflare.com further confirm Cloudflare’s role in the domain’s resolution. As of July 22, 2026, the domain is offline, though its prior operational status and impersonation of a cryptocurrency service warrant continued monitoring. Defenders should treat this domain as a confirmed phishing threat targeting Jito users.

Blocklist the domain and its resolving IP (188.114.96.3) at network and endpoint levels. Given the domain’s association with Cloudflare, review logs for connections to the IP or nameservers to identify potential prior compromise. No additional payloads or redirects were confirmed in the available data, but historical traffic to this domain should be investigated for credential theft or unauthorized transactions. The absence of SSL and minimal vendor detections do not reduce the risk; brand impersonation domains often evade initial scans before being widely flagged.