junovia[.]top

The domain junovia.top is classified as a high‑risk generic phishing site and remains active as of July 12, 2026. VirusTotal records indicate that 3 out of 95 scanned security vendors have flagged the domain, and it is listed on a single public blocklist where it is already blocked by PhishDestroy. The site returns HTTP 200 responses, suggesting an operational web service, and the overall trust score from Gridinsoft is 0 out of 100, reinforcing the hostile assessment.

Infrastructure analysis reveals that junovia.top was registered on August 09 2025 through Gname.com Pte. Ltd. The authoritative nameservers are aria.ns.cloudflare.com and arturo.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and reverse‑proxy services. DNS resolution points to IP address 172.67.156.61, which belongs to AS13335 owned by Cloudflare, Inc., and is geolocated to the United States. The TLS certificate is issued by Google Trust Services under the WE1 designation, and the site enforces HSTS while serving content over HTTP/3. Detected web technologies include Vue.js, which may be employed to render the phishing payload dynamically.

Defenders should continue to monitor junovia.top for any changes in detection metrics and consider adding the domain to internal blocklists across email gateways, web proxies, and endpoint protection solutions. Given the low trust score, the active status, and the presence on at least one external blocklist, it is prudent to treat any communication originating from or referencing this domain as malicious. Regular threat‑intel feeds should be consulted for updates, and any observed credential submissions or redirects should be captured for forensic analysis to aid in attribution and mitigation efforts.