jpp-ag[.]co[.]com

The domain jpp-ag.co.com is presently active and has been classified as a high‑risk Account Takeover phishing site. The designation stems from observed infrastructure characteristics and corroborating threat‑intel feeds that associate the domain with credential‑stealing activity.

The domain was registered on 21 February 2026 through Moniker Online Services LLC. DNS resolution points to the IP address 104.26.15.143, which belongs to the Cloudflare network (AS13335). All four authoritative name servers—ns1.nic.co.com through ns4.nic.co.com—are hosted on the same Cloudflare edge, and the site serves traffic over HTTP/3 with Cloudflare Browser Insights enabled. The TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint.

Automated analysis shows a 302 redirect delivering the page title “Account Suspended”. The site’s trust score from Gridinsoft is 0 out of 100, and it is listed on one public security blocklist. PhishDestroy has already blocked the domain, and two of ninety‑five VirusTotal scanners flagged it as malicious. The low trust score together with the redirect to an “Account Suspended” page are consistent with tactics used in account‑takeover campaigns that lure victims to a fake login portal before disabling access.

Given the confirmed infrastructure, defenders should add jpp-ag.co.com to network and email filtering blocklists, monitor DNS queries for the associated Cloudflare IP range, and enforce TLS inspection to capture the redirect behavior. Continuous re‑evaluation is advised, as the site remains active and may evolve its payload or hosting configuration.