jupapp[.]xyz

jupapp.xyz was registered on November 05, 2025 through Web Commerce Communications Limited and is currently hosted on Cloudflare infrastructure (ASN 13335) with the IP address 188.114.97.3 located in the United States. The domain resolves to two Cloudflare name servers, josephine.ns.cloudflare.com and watson.ns.cloudflare.com, indicating the use of a reputable DNS provider to obscure the true origin of the malicious service. No TLS certificate is presented; the site is reachable only via HTTP, which is consistent with the reported lack of an SSL certificate. The page title returned by the server is “Jupiter | Airdrop”, directly referencing the targeted brand “jupiter” and suggesting an airdrop‑related lure.

The kit identified on the site matches the publicly known “Airdrop Scam” package, which typically harvests cryptocurrency wallet seeds and private keys. Reputation checks show a Gridinsoft trust score of 0 out of 100, the lowest possible rating, and Google Safe Browsing classifies the URL as a social engineering threat. VirusTotal analysis recorded 11 detections out of 95 scanned engines, confirming that multiple security vendors consider the domain malicious. The domain appears on one external blocklist and has been actively blocked by the PhishDestroy community.

The overall risk assessment is high, and the site has been taken offline at the time of reporting. Defenders should block the domain and its associated IP address at network perimeter devices, update DNS sinkhole lists with the two Cloudflare name servers, and monitor for any future re‑registration attempts. Because the site leverages a generic Cloudflare front end, additional scrutiny of traffic to 188.114.97.3 for anomalous wallet‑seed requests is advisable. Continuous observation of the brand‑impersonation vector targeting “jupiter” is recommended to detect new campaigns that may reuse the same phishing kit or similar naming patterns.