swap-juq[.]ac

On July 22, 2026, investigators examined the domain swap-juq.ac, which was created on February 21, 2026 and currently resolves to the Cloudflare‑hosted address 104.21.19.177 in the United States (AS13335). The site presented the page title "Home | Jupiter," indicating an attempt to impersonate the Jupiter brand. The SSL certificate identified as "WE1" was observed, confirming the use of HTTPS but offering no indication of legitimate ownership. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, reinforcing the suspicion of malicious intent.

VirusTotal records show that the domain was scanned by 93 vendors, none of which reported a detection at the time of analysis; this absence of detections does not constitute confirmation of safety. The listed scam type is a crypto‑related fraud, consistent with the brand‑impersonation profile. Infrastructure analysis reveals that the hosting provider is Cloudflare, a common choice for threat actors seeking rapid deployment and anonymization. The site’s current HTTP status is offline, limiting immediate interaction but not eliminating the risk of reactivation.

Definitive evidence of the payload or credential‑harvesting mechanisms is not available, leaving the exact operational details uncertain. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP address, and add swap-juq.ac to internal threat‑intel feeds. Ongoing observation of Cloudflare‑hosted IP ranges for similar impersonation attempts is recommended, as is periodic re‑scanning with updated vendor engines to capture any future malicious changes.