jupapifix[.]pages[.]dev

On July 29, 2026 analysts observed that the domain jupapifix.pages.dev is actively being used for a high‑risk phishing campaign. The domain was registered on October 16, 2025 via Cloudflare Pages, a service that provides shared hosting and automatic TLS. Reputation checks show the domain appears on three independent security blocklists and is flagged by Google Safe Browsing for “social engineering”. VirusTotal reports eight of ninety‑one scanning engines have identified malicious activity associated with the host.

Additional defensive products, including PhishDestroy, MetaMask, and SEAL, have issued blocks against the domain, confirming its classification as a phishing vector. The unique seed 21c947 ties this observation to internal tracking. At present, no public page title or brand‑target information has been disclosed, leaving the exact impersonated entity unknown.

Nonetheless, the convergence of multiple detections across disparate platforms indicates a coordinated threat. Defenders should add jupapifix.pages.dev to outbound filtering rules, monitor DNS queries for the host, and enforce strict URL reputation checks. Continuous re‑evaluation is advised as further indicators, such as payload samples or victim reports, may emerge.