jpyc-bridge[.]pages[.]dev

Analysis of the domain jpyc-bridge.pages.dev indicates it is an active crypto drainer phishing site, currently under investigation. The domain was registered on April 19, 2026, through Cloudflare, Inc., and remains operational as of July 12, 2026. The page title, 'jpyc-bridge-react,' suggests a potential focus on cryptocurrency bridge services, though the exact content and functionality of the site have not been fully analyzed. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, associated with Cloudflare, Inc., and located in Canada. The site employs HTTPS with a Let's Encrypt SSL certificate (E8) and utilizes Cloudflare nameservers (kelly.ns.cloudflare.com, matt.ns.cloudflare.com). Technologies detected include HSTS and HTTP/3, consistent with modern web infrastructure. The domain has been flagged by one security blocklist and is classified as a crypto drainer, a type of phishing attack designed to siphon cryptocurrency from victims' wallets. Gridinsoft assigns it a trust score of 0/100, reinforcing its malicious classification. While no detections are currently reported by the 94 vendors that scanned the domain on VirusTotal, the absence of detections does not confirm safety. Defenders should treat this domain as hostile and prioritize blocking it at the DNS or network level. Further monitoring is advised to track any changes in its behavior or infrastructure.