s3-jupiter[.]icu

Analysis of the domain s3-jupiter.icu indicates it is a brand-impersonation scam targeting Jupiter, a cryptocurrency-related service, with elevated risk due to confirmed malicious infrastructure and limited but clear detection signals. The domain was registered on November 26, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing and fraudulent domains. It resolves to the IP address 104.21.76.176, which is part of AS13335 Cloudflare, Inc., a hosting provider commonly used to mask the true origin of malicious sites. The domain uses Cloudflare nameservers (johnathan.ns.cloudflare.com and sloan.ns.cloudflare.com), further obscuring backend infrastructure.

At the time of assessment, the domain appears offline, returning a page titled 'Just a moment...', which is consistent with Cloudflare interstitial pages or temporary takedowns. No SSL certificate was detected, increasing the likelihood of interception or impersonation risks. The domain is flagged by one security blocklist (PhishDestroy) and is detected by 3 of 95 security vendors on VirusTotal, confirming its classification as malicious by multiple independent sources. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk designation.

While the exact content of the site remains unanalyzed, the scam type is classified as a crypto scam, and the brand target is explicitly Jupiter. Defenders should treat this domain as active threat infrastructure, even in its offline state, due to its recent registration, Cloudflare hosting, and confirmed malicious detections. Network-level blocking is recommended, particularly for organizations in the cryptocurrency or financial sectors. Further monitoring of associated IPs and registrant patterns is advised to identify related campaigns.