jupsol[.]org

On 24 July 2026, the domain jupsol.org was observed as an offline site that mimics the brand Jupiter. The domain was registered on 7 November 2024 through NameSilo, LLC and resolves to the IPv4 address 91.195.240.12, which belongs to AS47846 (SED0 GmbH) in Germany. The authoritative name servers are ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. No TLS certificate is present, indicating the site was served over plain HTTP. The page title returned by the server is “jupsol.org - jupsol Resources and Information”, which does not contain any reference to the Jupiter brand, suggesting that content analysis has not yet been performed.

Threat intelligence flags jupsol.org as a brand‑impersonation campaign targeting Jupiter. VirusTotal reports a single positive detection out of 95 scanned engines, and two independent blocklist providers—PhishDestroy and ScamSniffer—have already listed the domain. Additionally, Gridinsoft assigns a trust score of 0/100, and the domain appears on two other security blocklists, reinforcing its malicious reputation. Uncertainty remains regarding the specific payload or credential‑collection mechanisms, as no HTTP response body or screenshot has been captured.

The lack of an SSL certificate prevents inspection of encrypted traffic, but the offline status limits immediate exposure. Defenders should continue to block the domain at perimeter filters, add the IP address 91.195.240.12 to deny‑list rules, and monitor for any future re‑activation. Continuous scanning with multi‑engine services is recommended to capture any changes in detection counts or new malicious content. Organizations using the Jupiter brand should issue user awareness alerts referencing the jupsol.org impersonation attempt.