jupkey[.]com

Analysis of jupkey.com shows a high‑risk brand‑impersonation campaign targeting the Jupiter brand. The domain was registered on 4 November 2025 through Dominet (HK) Limited and is currently taken offline. DNS resolution points to 188.114.96.3, a Cloudflare address (AS13335) located in the United States, indicating the use of a reputable content‑delivery network to mask the true hosting location. The domain is served without an SSL certificate, exposing any HTTP traffic to observation and confirming a lack of transport‑layer security.

Infrastructure signals are poor: the Gridinsoft trust score is 0 out of 100, and the site appears on one public security blocklist. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has explicitly blocked it. VirusTotal data record 14 detections out of 95 scanners, reinforcing the malicious assessment. The observed page title, "Jupiter | Airdrop," aligns with the deployed Airdrop Scam phishing kit, which is commonly used for wallet or seed credential harvesting.

The site claims to impersonate Jupiter, but concrete evidence of the content displayed has not been captured. Defenders should add the domain to internal blocklists, monitor DNS lookups for 188.114.96.3, and enforce TLS inspection to capture any future traffic if the site re‑appears. Continuous querying of Google Safe Browsing and VirusTotal for updates is advisable, as well as awareness‑raising for users of Jupiter‑related services about unsolicited airdrop solicitations.