jupiter-drop[.]vercel[.]app

Analysis of the domain jupiter-drop.vercel.app indicates that it was registered on 21 February 2026 through Tucows Domains Inc. The domain resolves to the IPv4 address 64.29.17.67, which is announced by Amazon.com, Inc. (AS16509) and geolocated to the United States. The TLS certificate presented is issued by Google Trust Services under the WR1 root, confirming the use of a valid certificate chain. HTTP probing returns a 404 status code with the page title “404: NOT_FOUND”, and the hosting platform is identified as Vercel with HTTP Strict Transport Security enabled. The domain is classified as a brand impersonation campaign targeting the Jupiter brand and is associated with a crypto‑scam motif.

VirusTotal analysis shows that one out of ninety‑three scanning engines flagged the domain, suggesting at least a minimal level of malicious confidence. Independent monitoring by PhishDestroy has placed the domain on its blocklist, and it appears on a single external security blocklist. Current evidence does not reveal any active phishing page, credential‑capture form, or malicious payload; the 404 response may indicate that the campaign is in a staging or takedown phase. The limited visibility of malicious content, combined with the single vendor detection, leaves the full operational intent uncertain.

Defenders should continue to monitor DNS resolution for the IP 64.29.17.67, enforce outbound filtering for connections to that address, and add the domain to blocklists used by email gateways and web proxies. Given the association with the Jupiter brand and the crypto‑scam label, organizations handling cryptocurrency transactions or communications with Jupiter‑related services should treat any unsolicited messages referencing this domain as suspicious. Ongoing threat‑intel feeds should be consulted for any future re‑activation, and any observed traffic should be logged for forensic correlation.