jupiters-chain[.]web[.]app

On 24 July 2026 analysts examined the domain jupiters-chain.web.app, which is hosted on Google’s Firebase platform and served over HTTPS using a Google Trust Services certificate (WR4). The domain resolves to the IPv6 address 2620:0:890::100, an address owned by AS54113 Fastly, Inc. in the United States. HTTP requests return a 404 status and the page title is “Site Not Found”, indicating that the content has been taken offline. The registration is handled by Google LLC and no custom nameservers are listed. Infrastructure fingerprints show that HSTS is enforced and the server supports HTTP/3, both typical of modern Firebase deployments.

Threat intelligence classifies the domain as a brand‑impersonation campaign targeting the Jupiter brand and labels the activity as a crypto‑scam. The domain appears on a single security blocklist and is specifically listed by PhishDestroy. VirusTotal analysis recorded detections from two of ninety‑five scanning engines, providing modest corroboration of malicious intent. No additional open‑source indicators such as OTX or Safe Browsing entries were identified beyond the blocklist entry.

The evidence confirms that the domain was created to mimic Jupiter‑related services, likely to lure victims into cryptocurrency‑related fraud, but the exact payload or lure page is not observable because the site is offline. Analysts lack visibility into any phishing landing pages, credential‑stealing forms, or malware distribution mechanisms that may have been hosted previously, leaving the full scope of the campaign, including victim count and financial impact, uncertain.

Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the IPv6 address 2620:0:890::100, and add the domain to internal threat‑intel feeds. Given the association with Fastly’s CDN and Firebase, organizations using these services should verify that no authorized sub‑domains have been compromised.