jupiter[.]yts-cs[.]net

The domain jupiter.yts-cs.net is presently active and resolves to the IPv4 address 150.95.146.85. Infrastructure analysis shows the domain is hosted on nameservers ns-a1.conoha.io, ns-a2.conoha.io, and ns-a3.conoha.io, all operated by the Conoha cloud provider. Registration records indicate the domain was created on 26 February 2020 through GMO Internet Group, Inc. d/b/a Onamae.com, a Japanese registrar. The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that it has been associated with malicious activity.

VirusTotal has processed the domain with scans from 91 antivirus and URL‑reputation vendors; none of the engines returned a positive classification at the time of analysis. While the absence of vendor detections does not imply legitimacy, it does highlight a potential evasion or a lack of current signatures for this particular campaign. Publicly available intelligence does not include details such as SSL certificate parameters, HTTP response codes, page title, or any observed brand targeting, leaving those aspects unverified. Consequently, defenders cannot rely on content‑based indicators and must focus on network‑level observables.

Recommendation is to block both the domain and its resolved IP address at perimeter firewalls, DNS filtering solutions, and endpoint security suites. Continuous monitoring of the associated IP range and the three Conoha nameservers is advised, as attackers may pivot to additional sub‑domains hosted on the same infrastructure. Organizations should also ensure that any user‑triggered alerts from the listed blocklists are escalated for investigation, and that credential‑phishing mitigation controls (e.g., email sandboxing, URL rewriting) are enabled to reduce exposure.