jupi-official[.]web[.]app

Analysis of jupi-official.web.app shows a domain that impersonates the Jupiter brand and is linked to a crypto‑scam campaign. The site resolved to IP 199.36.158.100, an address owned by Fastly, Inc. in the United States (AS54113). The hosting stack was identified as Firebase with HTTP/3 and HSTS enabled, and the TLS certificate was issued by Google Trust Services under the WR4 profile, consistent with a Google‑managed hosting environment. The domain was registered through Google LLC, which is typical for Firebase‑based deployments.

When accessed, the server returned an HTTP 404 status and the page title reported “Instant | Jupiter,” confirming the brand reference. VirusTotal recorded a single positive detection out of 95 scanned security vendors, indicating that at least one AV engine flagged the domain as malicious. The domain appears on one public blocklist and is specifically blocked by PhishDestroy, further corroborating its malicious reputation.

Current operational status is offline, suggesting the site has been taken down or is temporarily inaccessible, but the infrastructure artifacts remain observable. Defenders should continue to block the domain at perimeter and endpoint filters, monitor Fastly‑hosted Firebase assets for similar brand‑impersonation patterns, and enforce URL reputation checks against known blocklists. Because the underlying hosting provider is shared, future impersonation attempts may reuse similar infrastructure, so threat‑intel feeds should be updated with the observed certificate details, IP address, and page title for rapid correlation.