juplt-trade[.]sh

On July 23, 2026, the domain juplt-trade.sh was identified as a malicious phishing infrastructure. The domain was first registered on August 08, 2025 through NiceNIC International Group Co., Limited. DNS resolution points to the IPv4 address 95.129.234.38, which is announced by AS57724 (DDOS-GUARD LTD) and geolocated to Russia. The host returns a HTTP 404 page title, indicating that the site currently serves a generic error response. No TLS certificate is presented, so all traffic would be unencrypted if the site were active. The authoritative nameservers are coraline.ns.cloudflare.com and seth.ns.cloudflare.com, both belonging to Cloudflare's DNS service.

Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. The domain appears on a single public blocklist, specifically PhishDestroy, which has already taken the site offline. VirusTotal analysis shows that 15 of 95 scanning engines flagged the domain as malicious, confirming the consensus that it is being used for phishing. The limited visibility on blocklists and the absence of SSL suggest a short-lived or opportunistic campaign. Uncertainty remains regarding the exact phishing payload, targeted brand, or credential-harvesting page because the site currently returns only a 404 error and no further content has been harvested. No additional intelligence such as Safe Browsing or OTX identifiers is available at this time.

Defenders should continue to block the domain and its resolving IP address at perimeter and endpoint filters. Organizations using threat intelligence feeds should ingest the PhishDestroy indicator and consider adding the IP 95.129.234.38 to reputation lists. Ongoing monitoring of Cloudflare nameservers for new A records associated with this domain is recommended, as malicious actors may repoint the domain to a different host after takedown.