jupiterbroadcast[.]xyz

Analysis of jupiterbroadcast.xyz, created on September 12, 2025 and now taken offline, shows a high‑risk brand‑impersonation campaign targeting the Jupiter brand. The domain resolves to the IPv6 address 2620:0:890::100, which is assigned to Fastly, Inc. (AS54113) in the United States, indicating the use of a content‑delivery network for hosting. No SSL certificate is present, meaning the site operates without HTTPS encryption. The HTTP response presents a page title of "Site Not Found," suggesting the site is currently unavailable or deliberately removed.

Google Safe Browsing flags the domain for social engineering, and it is listed on two security blocklists, where it is actively blocked by PhishDestroy and ScamSniffer. VirusTotal reports that 13 of 95 scanning engines have flagged the domain, reinforcing the malicious assessment. The registrar listed is OwnRegistrar, Inc., and the authoritative nameservers are dns1.webproserver.com and dns2.webproserver.com. Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of reputation.

The threat is classified as a crypto scam that impersonates Jupiter, though no further details about the payload or luring technique are available. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and incorporate the IPv6 host into threat‑intel feeds. Additional investigation should focus on any associated Fastly edge nodes that may host related payloads, and on the nameserver infrastructure for potential reuse in future campaigns.