jup-activity[.]xyz

Analysis as of July 24 2026 indicates that the domain jup-activity.xyz is being used to impersonate the Jupiter brand in a crypto‑related scam. The domain resolves to the Cloudflare‑hosted address 188.114.97.3, which is announced by AS13335 and geolocated to the United States. Registration data shows the domain was created on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, and the authoritative name servers are ezra.ns.cloudflare.com and jocelyn.ns.cloudflare.com. No TLS certificate is presented; the site serves over plain HTTP, and the page title returned by the server is the generic string “Just a moment…”. Gridinsoft assigns a trust score of 0 / 100, reflecting a high confidence of malicious intent.

VirusTotal records indicate that ten of ninety‑five scanning engines have flagged the domain, confirming its malicious reputation. The domain is listed on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that it is a high‑risk indicator. The observed activity aligns with the “Crypto Scam” classification, although the exact payload or harvesting mechanics have not been disclosed. Because the infrastructure is hosted on Cloudflare, the IP address may be shared with unrelated legitimate services, complicating takedown efforts. Defenders should immediately add jup-activity.xyz to domain‑based deny lists across firewalls, DNS filters, and endpoint security solutions.

Correlation of outbound connections to 188.114.97.3 should trigger alerts, and any traffic bearing the “Just a moment…” page title should be inspected for malicious redirects. Monitoring of the two Cloudflare name servers for future sub‑domains that reference Jupiter or crypto terminology is advisable. Since the site is currently offline, continuous re‑resolution checks are recommended to detect potential re‑hosting.