jups[.]zone

This analysis documents the infrastructure observed for the domain jups.zone, which is currently classified as a delivery_scam with a high risk rating. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted behind Cloudflare’s network (AS13335, United States). DNS resolution returns the IP address 188.114.97.3, and the authoritative name servers are pete.ns.cloudflare.com and ariella.ns.cloudflare.com, indicating that the operator is leveraging Cloudflare’s CDN and security services. The site presents a page title of “Nur einen Moment…”, returns an HTTP 403 status code, and negotiates HTTP/3 connections. Cloudflare Browser Insights and a Google Trust Services / WE1 TLS certificate are observed, confirming the use of modern transport and encryption. VirusTotal reports that 2 of 93 scanning engines have flagged the domain, and the Gridinsoft trust score is 0 / 100, reflecting a poor reputation. The domain is listed on one public blocklist and has been blocked by the PhishDestroy service, confirming that security communities have taken remediation steps. Because only limited surface‑web evidence is available, the exact payload or phishing page content remains unverified, and the “Nur einen Moment…” title provides no clear indication of the lure used. Defenders should add jups.zone and its resolving IP 188.114.97.3 to blocklists, enforce DNS sinkholing, and monitor outbound traffic for connections to Cloudflare‑served endpoints that may be leveraged for further malicious delivery. Continuous re‑analysis is recommended to detect any changes in page content or additional infrastructure components.