aeriygdcjdiugcjjtjywzxgtrsnbwtnlz[.]com

Analysis of the domain aeriygdcjdiugcjjtjywzxgtrsnbwtnlz.com indicates it was actively impersonating Jupiter, a decentralized finance (DeFi) platform, as part of a cryptocurrency scam. The domain was registered on October 12, 2025, through NiceNIC International Group Co., Limited, and resolved to the IP address 185.111.111.158, hosted on AS212238 (Datacamp Limited) in Germany. No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'Jupiter: The DeFi Superapp | Jupiter,' directly matches the branding of the legitimate Jupiter platform, confirming the intent to deceive users into believing the site was authentic. Infrastructure analysis reveals the domain was flagged by seven out of 95 security vendors on VirusTotal, though the specific detection rules or signatures are not publicly detailed.

It appeared on one security blocklist and was included in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious activity. The domain was blocked by PhishDestroy and has since been taken offline, though historical resolution data confirms it was operational prior to its removal. Nameservers for the domain were hosted under coco.bunny.net and kiki.bunny.net, a configuration that may facilitate rapid domain rotation or bulletproof hosting practices. The absence of an SSL certificate further aligns with low-effort phishing infrastructure, though this alone does not confirm the sophistication of the operation.

Defenders should treat this domain as part of a broader cryptocurrency scam campaign targeting Jupiter users, particularly those engaged in DeFi transactions. While the domain is no longer resolving, organizations should monitor for re-registration or reuse of the same IP, nameserver, or registrar infrastructure. Indicators such as the IP 185.111.111.158, AS212238, and the nameservers coco.bunny.net and kiki.bunny.net should be incorporated into threat hunting and blocking rules.