jup-s3[.]org

The domain jup-s3.org has been identified as a phishing site engaged in brand impersonation, specifically targeting the brand Jupiter. This domain was used in a scam related to cryptocurrency, posing an elevated risk to users who might encounter it. As of now, jup-s3.org has been taken offline, reducing its immediate threat level, but users should remain cautious if they have interacted with it.

Technical indicators for jup-s3.org include its detection by 2 of 95 security vendors on VirusTotal, highlighting its malicious nature. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on January 05, 2026, and resolves to the IP address 172.67.188.213, located in the US under AS13335 Cloudflare, Inc. It has been listed on three security blocklists: PhishDestroy, MetaMask, and SEAL. The SSL certificate information is not available, and the page title observed was 'しばらくお待ちください...'. AlienVault OTX found this domain in 2 threat intelligence pulses.

Users who have interacted with jup-s3.org should take immediate safety actions. For those involved in cryptocurrency transactions, it is crucial to revoke token approvals and move funds to a new wallet to prevent unauthorized access. If credential or login information was provided, users should change their passwords, enable two-factor authentication, and monitor their accounts for any fraudulent activity. To report phishing or any suspicious activity, users can contact their local cybercrime authorities or report directly to platforms like Google Safe Browsing.