jupmarkets[.]press

This domain, jupmarkets.press, is identified as a brand impersonation threat specifically targeting Jupiter, a known decentralized finance platform. Analysis indicates the domain was designed to mimic legitimate Jupiter exchange interfaces, likely to deceive users into disclosing sensitive credentials or authorizing fraudulent transactions. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with common impersonation tactics used in credential theft and wallet compromise schemes. Infrastructure analysis reveals the domain was registered on March 15, 2026, through NameSilo, LLC, and resolves to the IP address 188.114.97.3. Security vendor assessments on VirusTotal show 9 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Additional technical indicators include the use of Cloudflare for hosting and traffic obfuscation, a Let's Encrypt SSL certificate, and the presence of Cloudflare Browser Insights and HTTP/3 technologies. Gridinsoft assigned a trust score of 0 out of 100, further corroborating its malicious classification. As of the latest assessment, jupmarkets.press has been taken offline, reducing immediate exposure to end users. However, the domain's infrastructure remains a latent risk, as threat actors may reactivate it or repurpose similar domains for future campaigns. Users who interacted with the domain should revoke any suspicious wallet authorizations and monitor accounts for unauthorized activity. Organizations are advised to proactively block the domain and its associated IP address in network security controls to prevent potential re-emergence. Continuous monitoring of newly registered domains with similar naming patterns is recommended to mitigate ongoing impersonation risks.