# PhishDestroy threat dossier — jupiter-swap.org ================================================================ Fetched: 2026-05-16 20:11:57 UTC Canonical: https://phishdestroy.io/domain/jupiter-swap.org/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 76/100 (PhishDestroy scoring — see methodology below) Targeted brand: Jupiter ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 18/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Ermes, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Sophos, VIPRE, Webroot URLQuery: 2 detections Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 130.12.180.128 (NL, Amsterdam) ASN: AS202412 Omegatech LTD Hosting org: Virtualine Technologies Registrar: DYNADOT LLC Nameservers: ns1.dyna-ns.net, ns2.dyna-ns.net Registered: 2026-04-01 Page title: Jupiter Exchange | Solana DEX | jup ag ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-01 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-16 21:24:18 UTC (by PhishDestroy tracker) First reported: 2026-05-16 18:26:50 UTC (abuse notice filed) Last verified: 2026-05-16 21:45:05 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e3206-573f-768a-863c-6b40965ac039/ URLQuery: https://urlquery.net/report/66fe8ad8-a245-4321-9411-156393a61ff6 Wayback Machine: https://web.archive.org/web/*/jupiter-swap.org crt.sh CT logs: https://crt.sh/?q=%25.jupiter-swap.org Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=jupiter-swap.org AlienVault OTX: https://otx.alienvault.com/indicator/domain/jupiter-swap.org URLhaus: https://urlhaus.abuse.ch/host/jupiter-swap.org/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-16 21:24:38 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies jupiter-swap.org as an active brand impersonation phishing site targeting Jupiter users. This fraudulent domain leverages Jupiter's trusted reputation to deceive visitors into connecting wallets or entering credentials, risking fund theft or account takeover. The site resolves to IP 130.12.180.128, hosted under a Let's Encrypt SSL certificate and registered anonymously through Dynadot LLC. Initial evidence suggests this domain is part of a coordinated campaign, with 18 of 95 security vendors flagging it on VirusTotal and inclusion on one public blocklist. Notably, MetaMask has proactively blocked access to this domain, indicating high confidence in its malicious nature. The domain was registered on April 1, 2026, a recent creation that aligns with the surge in crypto-related phishing attacks during the spring of 2026. This domain poses an elevated risk due to its precise mimicry of Jupiter's official branding and user interface. The threat actor behind jupiter-swap.org appears to be harvesting wallet credentials, seed phrases, or transaction approvals from unsuspecting users who assume the site is legitimate. Technical analysis reveals that the domain's SSL certificate was issued by Let's Encrypt, a tactic commonly used to lend false legitimacy to phishing pages. The registration through Dynadot LLC, a privacy-focused registrar, suggests the threat actor is attempting to obscure their identity, while the VirusTotal detection rate of 18/95 indicates partial coverage by security tools but insufficient global blocking. The inclusion on one public blocklist further highlights the need for proactive user vigilance, as traditional defenses may not catch this threat in time. Users who have visited jupiter-swap.org should immediately disconnect their wallets and revoke any connected permissions through their wallet's interface. If credentials or seed phrases were entered, transfer remaining funds to a new wallet immediately and enable two-factor authentication on all related accounts. Report the domain to your wallet provider and local cybersecurity authorities to aid in broader blocking efforts. Avoid interacting with any pop-ups or prompts from the site, as these may lead to further compromise. For ongoing protection, use hardware wallets for critical transactions and verify all URLs against Jupiter's official channels before engaging. Stay informed by following updates from PhishDestroy and other trusted threat intelligence sources. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260516-DE67B5 Favicon MD5: 620be14cd24a4f97d4735f8b1386a345 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/jupiter-swap.org/ JSON API: https://api.destroy.tools/v1/check?domain=jupiter-swap.org Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 150,180 domains (30,628 alive under monitoring, 118,098 confirmed takedowns/dead). Site: https://phishdestroy.io