jupit-ar[.]com

The domain jupit-ar.com was observed as part of a brand‑impersonation campaign targeting the Jupiter brand. The authoritative name servers ns1-us.v-sys.org and ns2-us.v-sys.org resolve the domain to the IPv4 address 91.222.173.30, which belongs to the NL‑based AS43641 network operated by SOLLUTIUM EU Sp z.o.o. The domain was registered through Name SRS AB on 8 November 2025. No TLS certificate was presented, and an HTTP request returned the generic directory listing page titled “Index of /”.

The site has been taken offline at the time of reporting, but it was previously blocked by the PhishDestroy service and appears on a single security blocklist. Reputation services rate the hosting infrastructure at a Gridinsoft trust score of 0 out of 100, indicating a highly suspicious environment. Malware and phishing intelligence sources have flagged the domain; AlienVault OTX lists it in one pulse, and VirusTotal recorded 12 positive detections out of 95 scanners.

The combination of a low‑trust host, lack of encryption, and multiple vendor detections suggests a deliberate attempt to lure victims into disclosing credentials or personal data under the guise of the Jupiter brand. Defenders should add the domain to internal deny lists, monitor DNS queries for the associated IP and name‑server pair, and ensure that any outbound connections to the address are blocked. Because the site is offline, incident response teams should still review recent logs for any successful connections before takedown, and consider notifying affected users if credential capture is suspected.