jupiter-qq[.]com

The domain jupiter-qq.com is currently listed as offline but retains a set of indicators that suggest it was used for a brand‑impersonation crypto scam targeting the Jupiter brand. The domain was registered on 16 October 2025 through Dominet (HK) Limited and is delegated to the Cloudflare nameservers emely.ns.cloudflare.com and thaddeus.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is associated with the host, indicating that any web service would have been delivered over plain HTTP. Reputation services have assigned the domain a near‑zero trust rating; Gridinsoft reports a score of 0 out of 100.

PhishDestroy has actively blocked the domain, and it appears on one public blocklist. VirusTotal scans show that five of ninety‑five antivirus engines flagged the domain as malicious, and AlienVault OTX references the domain in a single threat‑intelligence pulse. The page title returned by the server, “Nur einen Moment…”, is a German phrase meaning “Just a moment…”, which is commonly used by malicious pages to create a brief loading delay before redirecting or serving malicious content. The domain is explicitly categorized as a crypto scam and is noted to impersonate the Jupiter brand.

Because the site is offline, the exact payload, phishing kit, or malicious redirects cannot be verified at this time. The lack of an SSL certificate, combined with the low trust score and blocklist entries, strongly suggests that the domain was intended to lure victims into a fraudulent cryptocurrency transaction or credential harvest under the guise of Jupiter. Defenders should continue to block DNS resolution for jupiter-qq.com, monitor for any resurgence of the domain or similar Cloudflare‑hosted aliases, and update endpoint and web‑gateway filters with the observed indicators, including the IP address 188.114.96.