jupiter-perp[.]pro

Analysis of www.jupiter-perp.pro indicates a high-risk phishing domain actively targeting cryptocurrency users. The domain is currently live, resolving to IP address 186.2.175.35, and has been flagged by four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. These blocklists specialize in identifying fraudulent schemes, particularly those involving wallet credential theft or crypto-related scams. The domain lacks functional nameservers, a common tactic to evade detection or takedown efforts, though this may also result from misconfiguration or hosting instability. VirusTotal scans reveal that 4 out of 91 security vendors classify this domain as malicious, providing further evidence of its suspicious nature.

While the detection rate is not overwhelming, the combination of blocklist flags and vendor detections suggests a deliberate attempt to deceive users. No registrar or hosting provider details are currently available, limiting attribution efforts. The IP address 186.2.175.35 is hosted in a region with a history of abuse, though no specific autonomous system number or country-level attribution is confirmed. Defenders should treat this domain as an active threat, particularly for users of cryptocurrency platforms.

The presence of MetaMask and ScamSniffer blocks strongly implies a focus on wallet credential harvesting or fraudulent transaction schemes. Organizations should update web filters, endpoint protection, and email security policies to block access to this domain. Further investigation into the site’s content—such as page scripts, form submissions, or wallet addresses—is recommended to confirm the exact phishing mechanism. Given the domain’s persistence despite blocklist flags, monitoring for related infrastructure or newly registered lookalike domains is advised.