jupiter-nexus[.]xyz

On July 24, 2026, analysis of the domain jupiter-nexus.xyz was performed following its removal from active service. The domain was registered on February 27, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.138.130, which is advertised as being located in the United States under ASN 13335 (Cloudflare, Inc.). The authoritative nameservers listed are nico.ns.cloudflare.com and rihana.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate was observed, meaning HTTPS connections would be unavailable or would fall back to HTTP. The only visible HTTP response consisted of the page title "Just a moment…", providing no substantive content for further forensic examination.

The site was classified as a crypto-scam that impersonates the brand "jupiter", and it was flagged by the security‑blocking service PhishDestroy. It also appears on a single external blocklist, and VirusTotal reported detections by two of its 93 scanning engines. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The current status is reported as "taken offline".

While the limited public footprint prevents confirmation of the exact phishing workflow, the combination of brand impersonation, crypto-scam labeling, lack of SSL, and low trust scores strongly suggests that the domain was used to lure victims into a fraudulent transaction or credential‑stealing operation. Defenders should continue to block the domain at perimeter filters, update DNS sinkhole configurations, and add the IP address 172.67.138.130 to any relevant deny lists, acknowledging that the address is shared among many Cloudflare customers. Monitoring for new domains registered with the same registrar or similar naming patterns is advisable, as the attacker may reuse the same infrastructure.