jup[.]la

Analysis of the domain jup.la indicates active phishing infrastructure targeting FASTPANEL users, as evidenced by the page title and security vendor classifications. The domain was registered on October 8, 2025, through Key-Systems GmbH and currently resolves to 188.114.97.3, an IP address within AS13335 (Cloudflare, Inc.) located in the United States. The site returns an HTTP 521 status, suggesting server-side issues or deliberate misconfiguration to evade detection, while still remaining operational. Infrastructure analysis reveals Cloudflare nameservers (alaric.ns.cloudflare.com, novalee.ns.cloudflare.com) and HTTP/3 protocol usage, consistent with modern phishing campaigns leveraging content delivery networks for resilience and anonymity. Security vendor assessments further support the malicious classification: 11 of 95 engines on VirusTotal flag the domain, and Google Safe Browsing explicitly categorizes it as engaging in social engineering. The domain appears on one security blocklist, and its trust score is rated 0/100 by Gridinsoft. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate legitimacy, as phishing sites commonly abuse free or automated certificate authorities. While the exact phishing kit or payload remains unconfirmed, the combination of FASTPANEL branding, Cloudflare hosting, and social engineering flags strongly suggests credential harvesting or unauthorized control panel access attempts. Defenders should treat this domain as high-risk and implement blocking measures at DNS, IP, and certificate levels. Further investigation into associated IP ranges (188.114.96.0/24) and registrar activity may uncover additional linked infrastructure. No evidence currently indicates takedown or remediation efforts, and the domain remains active as of July 12, 2026.