jellyjelly-dev[.]xyz

Analysis of jellyjelly-dev.xyz shows a newly created domain (registered on December 22, 2025) that was actively serving content before being taken offline. The domain resolves to the Cloudflare edge address 172.67.152.239, which is associated with AS13335 Cloudflare, Inc., and is located in the United States. DNS resolution is handled by the Cloudflare nameservers ram.ns.cloudflare.com and simone.ns.cloudflare.com, indicating the use of Cloudflare’s CDN and security services. An HTTPS endpoint is present, secured by a certificate issued by Google Trust Services under the WE1 root, and the site enforces HTTP Strict Transport Security (HSTS).

HTTP/3 support and Cloudflare Browser Insights are also detected, confirming modern protocol usage. The HTTP response code returned was 200, and the page title presented to visitors was "CAPTCHA," suggesting a potential gatekeeper or verification step before further interaction. The domain appears on two independent phishing blocklists—PhishDestroy and ScamSniffer—and has been flagged by three of ninety‑three VirusTotal scanners, reinforcing its malicious reputation despite the limited detection count. The registrar listed as REGRU-RU is known to host disposable or short‑lived domains, a pattern consistent with phishing infrastructure.

Current status is offline, which limits immediate observation but does not eliminate the risk of re‑activation. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑hosting on alternative IPs, and consider adding the associated IP range to threat intelligence feeds. Ongoing vigilance is advised, especially for any traffic that attempts to bypass Cloudflare’s protection by targeting the underlying IP directly.