december-jup[.]com

On 23 July 2026 the domain december-jup.com was observed to host a crypto‑related impersonation campaign targeting the brand Jupiter. The site was taken offline before this analysis was completed, but historical data indicate that the domain resolved to the Cloudflare address 172.67.173.133, which is associated with AS13335 in the United States. The domain was registered on 23 December 2025 through OwnRegistrar, Inc., and is served by the Cloudflare authoritative nameservers george.ns.cloudflare.com and sky.ns.cloudflare.com. No TLS certificate was presented, leaving the connection unencrypted.

VirusTotal recorded seven positive detections out of ninety‑three submitted scanners, and the domain appears on a single external blocklist. PhishDestroy flagged the domain for removal, and Gridinsoft assigned a trust score of zero out of one hundred, indicating a high confidence of malicious intent. The page title returned by the HTTP response was “Just a moment…”, which is consistent with a placeholder page often used during redirection or loading sequences. Given the available evidence, the infrastructure appears to rely on a reputable content‑delivery network, which can obscure the true origin of the malicious payload while providing a stable endpoint.

The lack of TLS, combined with the low trust score and multiple vendor detections, suggests that the domain was intended to lure victims into a crypto‑scam workflow, likely by masquerading as an official Jupiter communication. Defenders should continue to block the IP address 172.67.173.133 and the domain itself at perimeter filters, incorporate the registrar and nameserver information into threat‑intel feeds, and monitor for any re‑registration attempts. Ongoing reconnaissance of related Cloudflare‑hosted domains is recommended, as adversaries frequently recycle the same hosting provider for subsequent campaigns.