jupiter[.]earn-token[.]fun

This domain was registered on July 29, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IPv4 address 188.114.96.3. The authoritative name servers are donald.ns.cloudflare.com and paris.ns.cloudflare.com, indicating that the infrastructure is hosted behind Cloudflare’s DNS and proxy services. The domain appears on a single security blocklist and has been flagged by the PhishDestroy sinkhole, confirming that it is being used for a phishing campaign. VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors; none of the engines reported a detection at the time of analysis, but the absence of a flag does not imply that the site is benign.

No additional intelligence such as Safe Browsing verdicts, OTX sightings, SSL certificates, or HTTP response details is available in the current dataset. Consequently, the confidence in the exact payload or target brand is limited, and the specific phishing lure remains uncharacterised. Defenders should treat jupiter.earn-token.fun as a hostile indicator. Immediate mitigation steps include adding the domain and its resolving IP address 188.114.96.3 to DNS‑based blocklists, configuring web‑gateway filters to block HTTP(S) requests to the host, and monitoring outbound traffic for connections to Cloudflare‑served nameservers that resolve to the same address.

Continuous re‑scanning with VirusTotal or comparable services is advisable, as additional detections may appear later. Because the registrar is known and the domain age is only one day, the infrastructure is likely disposable; however, threat actors may reuse the same IP range for future campaigns, so network‑level alerts on traffic to 188.114.96.3 should be maintained. Until further forensic evidence is obtained, the domain should be considered active and malicious.