jptex[.]io

jptex.io is a newly registered domain (registered 21 Feb 2026) that currently hosts a high‑risk generic phishing site. The domain resolves to 172.67.192.168, an IP address owned by AS13335 Cloudflare, Inc., and the authoritative nameservers are magali.ns.cloudflare.com and patrick.ns.cloudflare.com. The site is protected by a Google Trust Services / WE1 TLS certificate and serves content over HTTP/3.

Direct HTTP requests return a 403 status code and the page title is “Just a moment…”, indicating the presence of a Cloudflare challenge page rather than a malicious landing page. Although the challenge page does not reveal the final payload, the surrounding infrastructure – Cloudflare edge, TLS certificate, and HTTP/3 support – is consistent with many phishing kits that hide their true content behind a browser‑validation step.

VirusTotal scans have flagged the domain in three out of ninety‑five vendor engines, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on a single public blocklist and has been added to the PhishDestroy blocklist, confirming that at least some security vendors consider it malicious. No explicit brand or service is advertised in the visible content, so the exact target of the phishing campaign remains uncertain.

Defenders should treat jptex.io as a high‑confidence threat indicator. Network‑level controls ought to block DNS resolution and HTTP(S) traffic to the domain and its underlying Cloudflare IP range. Continuous monitoring of the domain’s DNS records is advised, as the operators may switch to a different backend while retaining the same front‑end. Organizations should also update endpoint security signatures with the observed 403 response pattern and the “Just a moment…” title to catch any downstream redirects. Incident response teams should investigate logs for any connections to 172.67.192.168 and consider quarantine of compromised credentials if user interaction is suspected.