jup[.]tfb9[.]pro

jup.tfb9.pro was observed hosting a brand‑impersonation campaign targeting Discord users. The site presented the page title “Home | Jupiter,” which does not reference the victim brand, but the intelligence set indicates the domain was used to impersonate Discord as part of a crypto‑draining scam. Google Safe Browsing flagged the domain for social engineering, and two independent blocklists (PhishDestroy and ScamSniffer) have listed it. VirusTotal scans show nine of ninety‑five security vendors flagged the host as malicious, corroborating the blocklist findings.

The domain resolves to IP 104.21.59.216, an address owned by Cloudflare (AS13335) located in the United States, a common hosting choice for fast‑flux or abused infrastructure. No SSL certificate is deployed, and the site lacked published nameserver records, which limits attribution. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence that the host is malicious. The current status is offline, which suggests the operators have taken the site down or are rotating infrastructure.

Because the site is no longer reachable, active mitigation focuses on pre‑emptive blocking: adding the domain and its resolved IP to perimeter firewalls, DNS filtering, and endpoint allow‑list exclusions. Security teams should also monitor for newly registered subdomains under the same registrar or similar naming patterns, as the underlying campaign may resume under a different host. The lack of SSL and the low trust score are consistent with typical phishing‑kit deployments, and the presence on multiple blocklists confirms the domain’s involvement in a crypto‑scam targeting Discord users. Defenders are advised to continue sharing indicators of compromise with threat‑intel platforms and to enforce user education about unsolicited Discord‑related crypto offers.