jupiter-dex[.]biz

Analysis of jupiter-dex.biz, observed as offline as of the reporting date (23 July 2026), indicates a high‑risk brand‑impersonation operation targeting the Jupiter brand through a cryptocurrency airdrop lure. The domain was registered on 16 November 2025 via Web Commerce Communications Limited and presently resolves to the Cloudflare address 172.67.159.165, hosted within AS13335 in the United States. No TLS certificate is presented, confirming the absence of HTTPS protection. The authoritative nameservers carlos.ns.cloudflare.com and pola.ns.cloudflare.com further confirm reliance on Cloudflare's DNS infrastructure. Google Safe Browsing classifies the site under social engineering, and PhishDestroy has listed the domain on its blocklist, marking it as the sole entry among known security feeds.

VirusTotal scans show twelve of ninety‑five AV engines flagging the domain, consistent with a malicious classification. The landing page title reported as “Jupiter | Airdrop” aligns with the identified “Airdrop Scam” phishing kit, suggesting the payload is designed to entice victims with a fabricated airdrop claim tied to the Jupiter brand. The kit’s typical behavior includes credential harvesting and wallet address collection, although specific payload details for this instance remain unverified. Because the site is offline, HTTP response codes and the exact HTML content could not be retrieved, leaving the precise user‑facing elements unconfirmed.

No SSL/TLS fingerprint is available, and no additional infrastructure such as redirect chains or secondary hosting has been observed. Defenders should block DNS resolution for jupiter-dex.biz at the network perimeter, add the address 172.67.159.165 to IP block lists, and monitor Cloudflare name server queries for similar patterns. Email security gateways should flag any messages referencing a Jupiter airdrop, especially if they contain cryptocurrency wallet prompts.