jup-quantum[.]network

This domain, jup-quantum.network, is flagged as a high-risk crypto phishing endpoint targeting users of decentralized finance platforms. Analysis indicates the domain impersonates legitimate cryptocurrency services, likely deploying credential harvesters or wallet drainers to exfiltrate private keys or recovery phrases. No specific brand impersonation has been confirmed, but the naming convention suggests an attempt to mimic Jupiter (JUP) ecosystem components, a known target for phishing campaigns in the Solana ecosystem. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.41.75, a Cloudflare proxy endpoint commonly abused for anonymizing malicious traffic. It was registered on June 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. VirusTotal reports 2/95 security vendors flagging the domain as malicious, while AlienVault OTX lists it in a single threat intelligence pulse. Google Safe Browsing (GSB) status is currently unconfirmed, and no additional blocklist entries have been identified beyond the two vendor detections. The domain remains active as of this report, with no takedown actions observed. Response actions should include immediate blocking of the domain and its associated IP at the network perimeter, alongside monitoring for internal connections to 104.21.41.75. Given the high-risk classification and active status, organizations are advised to treat any interaction with this domain as a potential compromise of sensitive cryptographic material. Endpoint detection rules should be updated to flag processes attempting to resolve or connect to jup-quantum.network, with particular attention to browser-based wallet extensions or applications.