juplandia[.]xyz

This domain, juplandia.xyz, is currently active and resolves to the IPv4 address 57.129.97.29, which is allocated to OVH SAS in Germany (AS16276). The hosting provider is identified as OVH, and the name servers are chuck.ns.cloudflare.com and cora.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming that HTTPS connections are terminated with a valid Google‑issued certificate. HTTP requests receive a 200 status code, and the site serves content built with Node.js, Vue.js and the Nuxt.js framework, delivered over HTTP/3.

The page title returned by the server is “Jupiter | Airdrop”, directly referencing the target brand Jupiter and an airdrop theme, which aligns with the classification of a crypto‑related impersonation scam. The domain was registered on 20 November 2025 through NameCheap, Inc., and the creation date is consistent with recent phishing campaigns. VirusTotal analysis shows that 11 of 95 security vendors have flagged the domain, and the domain appears on a single external blocklist. PhishDestroy has added the domain to its blocked list, and Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of malicious intent.

The listed scam type is “Crypto Scam” and the employed phishing kit is identified as an “Airdrop Scam” kit. No additional content or credential‑collection pages have been observed beyond the title; the precise malicious payload or data‑exfiltration mechanisms have not been disclosed. Defenders should block both the domain and the associated IP address at the network perimeter, add the observed name servers to watchlists, and enforce URL filtering for any request containing the “Jupiter | Airdrop” title pattern.