jimmylist[.]pages[.]dev

On July 25, 2026, analysis of the domain jimmylist.pages.dev identified it as a credential‑phishing infrastructure. The site was registered on March 24, 2026 through Cloudflare, Inc., and the authoritative nameservers are alexis.ns.cloudflare.com and annalise.ns.cloudflare.com. DNS resolution points to the Cloudflare edge address 172.66.47.183, which is geolocated to the United States (CA) and is owned by Cloudflare, Inc. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid public certificate. The HTTP response returned a 403 status code, and the page title reported by the scanner is “Decentralized Launchpad”.

Detected front‑end libraries include Bootstrap, Swiper, and jQuery, while the server advertises HSTS, HTTP/3, and Cloudflare‑specific headers. Reputation signals are uniformly negative: Gridinsoft assigned a trust score of 0 / 100, and VirusTotal recorded a single positive detection out of 94 scanners. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, and is listed on two additional security blocklists referenced in the intelligence. The risk rating is elevated, and the current operational status is offline, indicating that the phishing page has been taken down or otherwise disabled.

Defenders should add jimmylist.pages.dev and its resolving IP 172.66.47.183 to network‑level deny lists, enforce DNS blocking, and monitor Cloudflare‑originated traffic for similar patterns. Continuous re‑verification of the domain’s status is recommended, as the infrastructure could be re‑activated under a new subdomain or IP address. The combination of a recent creation date, low trust score, and presence on multiple phishing blocklists makes this domain a high‑confidence credential‑phishing indicator.