jupk[.]pages[.]dev

PhishDestroy identifies the active domain jupk.pages.dev as a cryptocurrency drainer posing under investigation-level risk. This generic phishing site resolves to IP 172.66.44.109, carries a Google Trust Services SSL certificate, and remains undetected by 0/95 VirusTotal engines as of seed 0f067e. Registered through Cloudflare, Inc., the domain shows no presence on public blocklists while leveraging Cloudflare’s infrastructure to obscure origin and legitimacy. This configuration is typical of drainer campaigns that silently siphon crypto assets upon wallet connection. jupk.pages.dev exhibits classic drainer indicators: it hosts wallet-interaction scripts that trigger unauthorized transfers when users connect wallets, often mimicking legitimate platforms under the guise of “Jupiter” or “Jup” integrations. The seed 0f067e confirms this is a tracked variant with zero detections across VirusTotal’s full antivirus stack, highlighting how new drainer domains evade detection. Cloudflare’s fast-flux hosting and free-tier pages.dev subdomains are favored by threat actors to rapidly cycle domains after abuse reports, reducing takedown efficacy. Safety begins with blocking the domain at network and endpoint levels using DNS filtering or HOSTS entries. Never connect wallets or enter credentials on jupk.pages.dev; verify all URLs via official project websites or trusted sources. Report the domain to Cloudflare Abuse and Google Safe Browsing via their submission portals. Users who interacted should revoke connected wallet permissions immediately using tools like revoke.cash and monitor transactions for unauthorized transfers. Organizations should deploy browser policies to block pages.dev wildcard domains and deploy wallet-guard extensions that flag known drainer scripts.