jupofficialchain[.]web[.]app

Analysis indicates that the domain jupofficialchain.web.app is currently inactive, returning an HTTP 404 “Site Not Found” response. The domain is hosted on Fastly’s network (AS54113) in the United States and resolves to 199.36.158.100. SSL termination is provided by Google Trust Services under the WR4 certificate, confirming that the TLS handshake is valid but does not imply legitimacy of the hosted content. Infrastructure fingerprints show the use of Firebase, HSTS, and HTTP/3, which are common in legitimate Google‑hosted applications and are also leveraged by malicious actors to gain trust.

The registrar for the domain is Google LLC, and the domain appears on one public phishing blocklist (PhishDestroy). Google Safe Browsing classifies the site as “social engineering,” a label applied to sites that attempt credential harvesting or deceptive practices. VirusTotal scans have recorded detections from 12 of 95 security vendors, reinforcing the suspicion of malicious intent. No active nameserver records were returned (NS_NOT_FOUND), which may be a result of the domain being taken offline.

Because the site is no longer serving content, direct observation of payloads or credential‑capture mechanisms is not possible, leaving the exact phishing campaign details unknown. Defenders should continue to block the domain at network perimeter devices and update URL filtering rules. Incident response teams should correlate any recent authentication attempts or credential submissions that reference the domain with internal logs, and consider adding the domain to internal deny lists. Monitoring of Fastly’s IP range for similar Firebase‑based deployments is advised, as adversaries frequently reuse the same hosting infrastructure for new campaigns.