jackpociak[.]pro

This domain, jackpociak.pro, is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Ethereum brand. The site returns HTTP 307 redirects and presents a page title “JACKPOCIAK | Enter the world of sport and stakes!”. Analysis identifies the infrastructure as a Node.js application fronted by Envoy and built with React and Next.js, with HSTS enabled. The SSL certificate is issued by Google Trust Services under the WE1 identifier. The domain is registered through SD‑on​enetwork (ASN 16276) and resolves to 57.129.97.29, an IP located in Germany and associated with OVH SAS (AS16276). Nameservers david.ns.cloudflare.com and kay.ns.cloudflare.com indicate use of Cloudflare’s DNS and edge services, which also provide Cloudflare Browser Insights and a Facebook Pixel. The Gridinsoft trust score is 0 / 100, and the site appears on one security blocklist. PhishDestroy has blocked the domain, and VirusTotal reports three detections out of ninety‑five scanners. The observed phishing kit is labeled “Gambler Scam”. While the exact phishing payload and victim interaction flow have not been publicly disclosed, the combination of brand impersonation, cryptocurrency focus, and low trust score suggests a credible crypto‑scam operation. Defenders should block the domain and associated IP, monitor DNS queries for the listed nameservers, and update detection rules to flag HTTP 307 redirects from this infrastructure. Continuous observation of the blocklist status and VirusTotal re‑scans is recommended to capture any changes in threat activity.