snapshot-jupuary[.]xyz

The domain snapshot-jupuary.xyz was registered on 27 February 2026 through NiceNIC International Group Co., Limited. It resolves to the Cloudflare address 104.21.58.63, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The domain is currently marked offline and the hosting provider reports no SSL certificate, causing HTTP connections to be unencrypted. The only visible HTTP response contains the page title “Just a moment…”, which provides no functional content.

The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal analysis shows that two out of ninety‑three scanning engines flagged the host as malicious, confirming that at least a subset of security products consider it suspicious. Nameserver records point to alexis.ns.cloudflare.com and sara.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. Analysis indicates that the limited detection footprint, combined with the lack of TLS and the generic page title, suggests the site was used for a short‑lived phishing campaign, likely targeting users with a redirect or interstitial page.

Because the site is already taken offline, active exploitation appears to have ceased, but the infrastructure—particularly the Cloudflare‑managed IP—may be reused for future campaigns. Defenders should add the domain and its associated IP address to deny‑list rules in firewalls and proxy devices, monitor for any re‑appearance of the same IP range in outbound traffic, and ensure that any internal hosts that previously resolved the domain are cleared from DNS caches. Continuous monitoring of the two flagging vendors on VirusTotal and the PhishDestroy feed will provide early warning if the domain reactivates or if similar patterns emerge.