jup-ap[.]us[.]com

jup-ap.us.com was registered on 21 February 2026 through Instra Corporation Pty Ltd. The domain resolves to the IP address 104.21.83.21, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The authoritative nameservers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net. An SSL certificate identified as WE1 is present, indicating that transport encryption is enabled.

HTTP requests to the domain return a 301 permanent redirect. The landing page title, as observed in the HTTP response, is "Jupiter Fitness – Family Fitness Center", which references the legitimate Jupiter brand. The domain is currently listed on the PhishDestroy blocklist, confirming that at least one security vendor has flagged it as malicious.

The known intelligence categorizes the activity as a cryptocurrency‑related brand impersonation targeting the Jupiter brand. No malware detections were reported on VirusTotal at the time of analysis (0/95 scans), and the site has not been associated with additional public threat feeds. The exact payload, phishing forms, or payment instructions have not been disclosed, leaving the precise attack vector uncertain.

Given the active status, recent registration date, and confirmed blocklisting, defenders should monitor DNS resolutions for 104.21.83.21 and incorporate the domain into sink‑hole or URL filtering rules. Email gateways should be configured to flag any communications that reference the Jupiter brand and originate from this domain. Continuous re‑scanning on multi‑engine aggregator services is advisable to capture any future malicious content.

Analysts should also examine any related subdomains that share the same nameserver set or resolve to the same IP range, as threat actors often deploy multiple domains within a single Cloudflare account. Correlation with other recent registrations using Instra Corporation Pty Ltd. as registrar may reveal a broader campaign infrastructure.