jupag[.]space

PhishDestroy identifies jupag.space as a brand impersonation site targeting Jupiter users. The domain was registered on April 21, 2026, and is currently under investigation for distributing a crypto drainer kit designed to siphon cryptocurrency from unsuspecting victims. The threat actor leverages Jupiter’s branding to deceive users into connecting their wallets or entering sensitive credentials, with the ultimate goal of draining funds. This domain resolves to IP address 188.114.97.3 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. VirusTotal currently reports 10/95 detections, indicating it remains undetected by most antivirus engines. The site uses a Let’s Encrypt SSL certificate, adding a false sense of legitimacy. As of now, it is not flagged on Google Safe Browsing (GSB) and has not been added to any major blocklists, leaving potential victims exposed. jupag.space is currently active and poses an active threat to users interacting with the Jupiter brand. PhishDestroy has flagged this domain and is actively monitoring its behavior. While no immediate blocklist inclusion has occurred, users are strongly advised to avoid this domain entirely. The risk level remains under investigation, but the presence of a crypto drainer kit suggests a high likelihood of financial harm to victims. Always verify suspicious domains against PhishDestroy’s database before taking any action.