jup-ag[.]homes

The domain jup-ag.homes was registered on 29 November 2025 through Dynadot LLC and remains active as of 12 July 2026. Automated scans classify the site as a seed_phish operation that impersonates the Jupiter brand, with the page title “Swap | Jupiter” returned on an HTTP 200 response. Google Safe Browsing has listed the domain under the SOCIAL_ENGINEERING category, and two independent blocklists—PhishDestroy and ScamSniffer—have already added it to their deny lists.

Infrastructure analysis shows the domain resolves to the IP address 172.67.187.97, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Authoritative name servers are algin.ns.cloudflare.com and meiling.ns.cloudflare.com, indicating the domain is fully proxied behind Cloudflare’s network. No TLS certificate is presented, leaving the connection unencrypted despite the HTTP 200 status.

Reputation services reinforce the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 16 out of 95 scanned security vendors flag the domain as malicious. The lack of an SSL certificate, combined with the high‑confidence brand impersonation label and the presence on multiple blocklists, suggests a concerted effort to harvest credentials or redirect victims to fraudulent Jupiter‑related services. The exact payload, phishing form structure, and any backend command‑and‑control endpoints have not been publicly disclosed.

Defenders should prioritize immediate containment. Network‑level filtering should block traffic to jup-ag.homes, and DNS resolvers can be configured to return NXDOMAIN or sinkhole responses. Email gateways should add the domain to phishing block rules, and endpoint protection solutions should flag any attempted connections as malicious. Continuous monitoring of Cloudflare‑proxied IP ranges for new domains with similar naming patterns is advised to pre‑empt future seed‑phish deployments.