jup-campaign[.]xyz

This domain, jup-campaign.xyz, is a confirmed phishing site designed to impersonate the Jupiter platform through a fraudulent airdrop campaign. Analysis indicates the site presents a fake "Jupiter | Airdrop" page, likely intended to deceive users into disclosing sensitive credentials, wallet private keys, or other authentication details under the pretense of claiming rewards. The domain specifically targets users familiar with Jupiter, exploiting trust in the brand to facilitate credential harvesting or unauthorized transactions. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Eranet International Limited, and resolves to the IP address 172.67.214.90. Security vendor detections on VirusTotal show 13 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on two security blocklists and is actively blocked by multiple threat intelligence feeds. The combination of recent registration, brand impersonation, and security vendor detections underscores the elevated risk posed by this infrastructure. Users who visited jup-campaign.xyz should immediately revoke any wallet or application permissions associated with the site. If credentials or private keys were entered, affected accounts should be treated as compromised, and all related passwords or keys should be rotated. Monitoring for unauthorized transactions or account activity is recommended. The domain is currently offline, but users should remain vigilant for similar phishing attempts targeting Jupiter or other cryptocurrency platforms.