jup-ao[.]co[.]com

Analysis of jup-ao.co.com indicates an active crypto scam domain impersonating Jupiter, a known cryptocurrency platform. The domain was registered on February 21, 2026, through Moniker Online Services LLC and currently resolves to IP address 172.67.197.158, hosted on Cloudflare's infrastructure (AS13335). The site returns an HTTP 302 redirect status with an 'Account Suspended' page title, a common tactic to mask malicious activity or simulate service disruption. Two of 93 security vendors on VirusTotal flag this domain, and it appears on one security blocklist, including PhishDestroy. Nameservers point to nic.co.com, a pattern observed in other brand-impersonation campaigns. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate compromise but is frequently used by threat actors due to its free availability. Technologies detected include Cloudflare and HTTP/3, consistent with modern phishing infrastructure designed to evade detection and improve performance. Defenders should treat this domain as high-risk, particularly in environments where Jupiter or cryptocurrency-related services are accessed. Block the domain and IP at network perimeters, and monitor for connections to 172.67.197.158 or requests to jup-ao.co.com. Further investigation is required to determine the full scope of the scam, including any associated wallet addresses or redirection chains. The exact content of the site remains unanalysed, and no additional brand-specific artifacts have been confirmed beyond the stated impersonation of Jupiter.