jupitermobile[.]yaslabs[.]dev[.]br

This domain, jupitermobile.yaslabs.dev.br, is actively flagged as a high-risk social engineering phishing threat. Analysis indicates the domain was registered on June 05, 2026, and remains operational as of August 07, 2026. Google Safe Browsing explicitly classifies the site as engaging in social engineering tactics, a designation consistent with phishing activity targeting users through deceptive practices. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which further corroborates its malicious classification.

Infrastructure analysis reveals the domain resolves to IP address 185.199.108.153 and utilizes nameservers a.sec.dns.br and b.sec.dns.br. While the hosting provider and autonomous system details are not explicitly provided, the IP resolution suggests a potentially shared or bulletproof hosting environment, which is commonly leveraged for phishing campaigns. The domain's subdomain structure (yaslabs.dev.br) may indicate an attempt to exploit a compromised or misconfigured legitimate domain, though this remains unconfirmed without further forensic evidence. VirusTotal scans, conducted by 91 vendors, currently report no detections.

However, the absence of detections does not equate to safety, particularly given the domain's presence on multiple blocklists and its classification by Google Safe Browsing. Defenders should treat this domain as actively malicious and prioritize blocking it at the network and endpoint levels. Additional measures include monitoring for related subdomains or IPs, investigating potential credential harvesting or malware distribution tied to this infrastructure, and reviewing logs for any interactions with the domain or its associated IP. The exact content and target of the phishing campaign are not yet analyzed, but the social engineering classification suggests a focus on user deception rather than technical exploitation.