jupiternexus[.]click

The domain jupiternexus.click was registered on March 17 2026 through NameSilo, LLC and immediately pointed to the Cloudflare edge address 104.21.87.253 (AS13335, United States). The authoritative name servers are kehlani.ns.cloudflare.com and mark.ns.cloudflare.com, indicating the site is fully proxied behind Cloudflare’s network and benefits from HTTP/3 and Cloudflare Browser Insights. A passive request to the site returned the HTML title “Just a moment…”, which is the only observable content currently available. The site is classified as a crypto‑related scam that impersonates the Jupiter brand, aligning with the supplied “brand impersonation” and “Crypto Scam” descriptors.

Threat intelligence sources have flagged the domain on three independent blocklists, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that one of ninety‑four scanning engines raised a detection, reinforcing the suspicion that the domain is malicious. No additional security vendor reports are publicly disclosed, and no SSL certificate details or HTTPS validation results have been observed beyond the standard Cloudflare TLS termination. The domain’s current operational status is offline, suggesting that the operators have withdrawn the site after initial exposure.

However, the underlying infrastructure—namely the Cloudflare‑hosted IP address and the registrar—remains reusable for future campaigns. Defenders should therefore continue to monitor the IP 104.21.87.253 for re‑use, enforce blocking of the domain in enterprise web filters, and add the associated hostnames to threat‑intel feeds. Because the site leveraged a generic “Just a moment…” landing page, there is limited forensic evidence of the payload or user‑interaction flow; analysts should treat any future DNS resolution to the same IP or similar Cloudflare‑hosted domains as potentially related to the same threat actor.