jupi[.]pages[.]dev

Analysis as of July 29 2026 shows that the domain jupi.pages.dev was registered on 4 December 2023 through the Cloudflare Pages service. The domain resolves to the IPv4 address 172.66.47.164, which is hosted by Cloudflare. VirusTotal has recorded 15 detections out of 91 scanned security vendors, indicating that a significant minority of scanners consider the site malicious.

The domain is listed on five public blocklists and is actively blocked by the threat‑intel feeds PhishDestroy, MetaMask, ScamSniffer, SEAL, and Enkrypt, confirming its classification as a high‑risk phishing infrastructure. No additional metadata such as Safe Browsing status, OTX sightings, SSL certificate details, HTTP response codes, or page title information has been disclosed, so the exact payload or lure employed by the site remains unknown. The available evidence points to a generic phishing operation that leverages Cloudflare Pages to host malicious content, likely targeting users who trust the “pages.dev” sub‑domain pattern.

Defenders should immediately add jupi.pages.dev and its resolved IP 172.66.47.164 to URL filtering and firewall deny lists, ensure that any endpoint protection solutions ingest the five blocklist entries, and monitor for new domains registered with the same Cloudflare Pages registrar that exhibit similar detection patterns. Continuous re‑scanning of the domain with sandbox or URL reputation services is advised to capture any evolution in payload or hosting configuration. Organizations that employ strict DNS allow‑list policies should consider blocking the entire “pages.dev” namespace pending further analysis, as it is a known vector for malicious actors.