s3-jupiter[.]xyz

Analysis of s3-jupiter.xyz confirms its classification as a crypto scam site targeting the Jupiter brand, with infrastructure and detection patterns consistent with phishing operations. The domain, registered on November 26, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, currently resolves to Cloudflare IP 104.21.5.241 (AS13335) in the United States. No SSL certificate was detected, a common red flag for fraudulent sites, and the page title 'Nur einen Moment…' suggests a transient or cloaked loading state, often used to evade initial scrutiny.

Security vendors have flagged the domain, with 4 of 95 engines on VirusTotal identifying it as malicious, while it appears on at least one security blocklist and is actively blocked by PhishDestroy. The Gridinsoft trust score of 0/100 further corroborates its high-risk status. Cloudflare nameservers (amalia.ns.cloudflare.com, neil.ns.cloudflare.com) indicate the use of proxy services to obscure hosting details, a tactic frequently employed by threat actors to delay takedowns.

While the domain is currently offline, defenders should treat it as a confirmed threat vector for Jupiter-branded crypto scams. Historical DNS and WHOIS records should be preserved for forensic analysis, and any residual DNS resolutions or subdomains should be monitored for reactivation attempts. The absence of an SSL certificate and the use of a high-reputation CDN provider underscore the need for layered detection, including TLS inspection and behavioral analysis to identify similar campaigns.