lupimupitupilupi[.]com

This domain, lupimupitupilupi.com, is classified as a high‑risk generic phishing site. The page title returned by the server is “Error”, and the HTTP response is a 301 redirect, indicating that the site is actively serving malicious content. The domain was created on 1 September 2025 and remains active as of the report date, 12 July 2026. The authoritative name servers are david.ns.cloudflare.com and zelda.ns.cloudflare.com, both operated by Cloudflare. DNS resolution points to the IP address 172.67.173.129, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site is protected by a TLS certificate issued by Google Trust Services under the WE1 profile, and the transport layer includes support for HTTP/3. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com. Threat‑intelligence feeds have recorded the domain on two public blocklists, PhishDestroy and PhishingDB. VirusTotal analysis shows that eight out of ninety‑five scanned security vendors flagged the domain as malicious. AlienVault OTX cites the domain in sixteen separate threat‑intel pulses, reinforcing its association with phishing campaigns. Independent reputation scoring assigns a Gridinsoft trust score of 0 out of 100, indicating a lack of confidence in the domain’s legitimacy. Defenders should prioritize blocking both the domain and its resolved IP address at perimeter and endpoint layers. Continuous monitoring of DNS queries for the associated Cloudflare name servers can provide early warning of related activity. Because the TLS certificate is publicly trusted, network‑level inspection of HTTPS traffic or the use of a decryption proxy may be required to detect malicious redirects. Updating detection signatures with the observed blocklist identifiers and the unique seed b8b9a7 will improve coverage against this specific campaign.