jup-ag[.]co[.]in

The domain jup-ag.co.in was registered on September 16, 2025 through Endurance Digital Domain Technology Private Limited and is currently hosted on Cloudflare infrastructure (AS13335). DNS resolution points to the IP address 188.114.97.3, which resolves to a US location operated by Cloudflare, Inc. The domain lacks an SSL/TLS certificate, indicating that HTTPS connections are not available. The authoritative nameservers are bella.ns.cloudflare.com and scott.ns.cloudflare.com. The site’s page title, as observed in the limited crawl, reads "Jupiter: The DeFi Superapp | Jupiter," directly referencing the legitimate brand Jupiter.

VirusTotal analysis shows that nine out of ninety‑five security vendors flagged the domain, suggesting a moderate level of detection across independent scanners. The domain appears on two public blocklists—PhishDestroy and ScamSniffer—both of which have classified it as a malicious resource. The threat type is identified as a brand impersonation targeting Jupiter, and the associated scam category is a crypto‑related scam. The current operational status is offline, which may indicate that the infrastructure has been taken down or is temporarily unavailable.

However, the presence of the domain on blocklists and the detection count imply that the site was previously active and used for malicious purposes. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑hosting attempts on alternative IP ranges, and consider adding the domain to internal threat intel feeds. Given the lack of HTTPS, any future activation would likely rely on HTTP, making it easier to detect via network inspection. Continuous observation of the associated IP address and the Cloudflare ASN is recommended, as the same hosting environment may be reused for related campaigns.