jupdrops[.]pages[.]dev

The domain jupdrops.pages.dev is flagged as an active brand‑impersonation campaign targeting Cloudflare. The site was registered on 11 November 2025 through Cloudflare, Inc., and is served from the Cloudflare network (AS13335) with the IP address 172.66.47.71 located in the United States. DNS resolution uses the Cloudflare‑provided authoritative nameservers remy.ns.cloudflare.com and nova.ns.cloudflare.com, confirming that the attacker is leveraging Cloudflare’s infrastructure to host the malicious page. The TLS certificate presented by the site is issued by Google Trust Services under the WE1 profile, which is typical for Cloudflare‑hosted domains and provides a valid HTTPS connection. When accessed, the HTTP response returns status code 500 and the page title reads “Worker threw exception | jupdrops.pages.dev | Cloudflare”, indicating that the request is processed by a Cloudflare Worker that deliberately throws an exception, a technique often used to hide the underlying content while maintaining the appearance of a legitimate Cloudflare service page.

The site advertises HSTS and HTTP/3 support, consistent with Cloudflare’s default security stack. Reputation data show that three of ninety‑three VirusTotal scanners have flagged the domain, and it appears on a single external blocklist. The Gridinsoft trust score is 0 / 100, reflecting an extremely low trust rating. PhishDestroy has already added the domain to its blocklist, providing an early indicator of malicious intent. The campaign’s classification as brand impersonation is supported by the explicit reference to Cloudflare in the page title and the claim that the site “impersonates: Cloudflare”.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no content analysis is available. Defenders should therefore treat any interaction with jupdrops.pages.dev as suspicious.