jupi-dapp[.]web[.]app

Analysis of the domain jupi-dapp.web.app indicates it was actively involved in an investment scam operation, now flagged and taken offline as of July 24, 2026. The domain was hosted on Google's Firebase platform, resolving to the IP address 199.36.158.100, which is part of AS54113 (Fastly, Inc.) located in the United States. The SSL certificate was issued by Google Trust Services (WR4), a common provider for Firebase-hosted applications, which does not inherently indicate malicious activity but confirms the infrastructure used. The domain was registered through Google LLC, aligning with its Firebase hosting origin. At the time of this report, the domain returns an HTTP 404 status with the page title 'Site Not Found,' suggesting it has been disabled or removed.

This status is corroborated by its appearance on one security blocklist, specifically PhishDestroy, and a detection rate of 3 out of 95 security vendors on VirusTotal, indicating moderate but not universal recognition as malicious. Infrastructure analysis reveals the use of HSTS and HTTP/3 protocols, typical of modern web applications but not exclusive to legitimate services. The scam type was classified as an investment scam based on available threat intelligence, though the exact content or targeted brand remains unconfirmed due to the domain's current offline status. No nameservers were explicitly associated with the domain, which is consistent with Firebase's managed hosting environment.

Defenders should treat this domain as confirmed malicious for the purpose of blocking and monitoring. While the domain is currently offline, historical resolution to 199.36.158.100 and its association with AS54113 may warrant further scrutiny of related infrastructure. Given the limited detection on VirusTotal and single blocklist entry, additional retrospective analysis of network logs for connections to this IP or domain is recommended to identify potential prior compromise.