jupiter[.]freetoken[.]fun

Analysis of jupiter.freetoken.fun shows a newly registered domain created on July 20, 2026 that is currently active and resolves to the Cloudflare IP address 104.21.85.232. The domain is hosted on Cloudflare’s infrastructure, as indicated by its authoritative name servers ace.ns.cloudflare.com and meg.ns.cloudflare.com. Registration details list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar, a pattern frequently observed in short‑lived malicious sites. VirusTotal reports that 2 of 95 security vendors have flagged the domain, providing early but limited vendor consensus of malicious intent. Independently, the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a phishing vector. The combination of a same‑day registration, Cloudflare edge hosting, minimal vendor detections, and presence on a dedicated phishing blocklist suggests a high‑risk profile despite the low detection count. Defenders should add the domain to deny lists at perimeter and DNS filtering layers, monitor outbound connections to the associated IP, and consider broader threat‑intel correlation for other domains sharing the same Cloudflare name servers or registrar. Continuous re‑scanning of the domain on multi‑vendor platforms is recommended to capture any escalation in detection rates.