juphub[.]net

Analysis of the domain www.juphub.net, registered on February 21, 2026, indicates active infrastructure supporting a crypto scam impersonating the Jupiter brand. The site resolves to IP address 64.29.17.65, hosted on Amazon Web Services (AS16509) in the United States, and is served via Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com). The domain returns an HTTP 200 status, signaling an operational web server, and presents a page titled 'Jupiter Hub,' directly aligning with the targeted brand. A Let's Encrypt SSL certificate (R13) is deployed, and HSTS is enabled, which may lend a superficial appearance of legitimacy while obscuring malicious intent.

The domain is flagged on at least one security blocklist (PhishDestroy) and has been assigned a Gridinsoft trust score of 0/100, reflecting confirmed malicious activity. VirusTotal records indicate that one of 93 security vendors has detected this domain as malicious, though the specific detection context remains unverified. Registration details point to Tucows Domains Inc. as the registrar, a common choice for both legitimate and fraudulent domains. Infrastructure analysis reveals no evidence of takedown or disruption as of July 22, 2026.

Defenders should treat this domain as high-risk and prioritize blocking at the network and endpoint levels. Security teams are advised to monitor associated IP addresses and nameservers for additional malicious domains, as shared infrastructure is frequently reused in phishing campaigns. The exact content and functionality of the site remain unanalyzed, but the available indicators—brand impersonation, crypto scam classification, and active hosting—warrant immediate containment measures.