treasury-jupiter[.]icu

Analysis of treasury-jupiter.icu shows the domain was created on 12 December 2025 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers are benedict.ns.cloudflare.com and megan.ns.cloudflare.com, pointing the domain to the Cloudflare edge IP 172.67.162.195, which belongs to ASN 13335 in the United States. No TLS certificate is presented, meaning HTTPS connections would be unencrypted or result in a certificate error. The only visible HTML element captured is the page title “Nur einen Moment…”, which does not reveal any brand‑specific content but is consistent with a placeholder often used in fraudulent redirects.

The site is classified as a crypto‑scam that impersonates the Jupiter brand, and it has been flagged by five of ninety‑five VirusTotal scanners. External threat‑intel sources have added the domain to a single security blocklist and PhishDestroy reports it as taken offline. The combination of brand impersonation, a recent registration date, use of Cloudflare’s free DNS, lack of SSL, and partial detection by antivirus engines supports an elevated risk rating.

Uncertainty remains around the exact payload delivered to victims because no page content beyond the title has been publicly harvested. Defenders should add treasury-jupiter.icu and its resolved IP 172.67.162.195 to network‑level blocklists, monitor Cloudflare‑associated traffic for anomalous redirects, and enforce TLS inspection policies to detect any future payload if the domain is reactivated. Continuous re‑scanning with VirusTotal or similar services is advised to capture any evolving malicious code.