jup2026[.]onspace[.]app

The domain jup2026.onspace.app is flagged for brand impersonation, specifically targeting the brand Jupiter. This domain was likely created to deceive users by posing as an official Jupiter page, potentially for financial gain or to steal sensitive information. There is no evidence of a specific drainer kit, but the threat is classified as high due to the deceptive nature and potential for significant user impact.

Infrastructure analysis reveals that the domain jup2026.onspace.app has been flagged by 12 out of 95 security vendors on VirusTotal, indicating a moderate level of consensus among security experts regarding its malicious nature. The domain is registered through NameCheap, Inc., and resolves to the IP address 43.130.171.225, which is located in the United States and associated with AS132203 Tencent Building, Kejizhongyi Avenue. The domain was created on February 21, 2026, and has been flagged by Google Safe Browsing as a phishing site. Additionally, the domain appears on 4 security blocklists, further corroborating its malicious intent.

The domain is currently offline, which may indicate that it has been taken down by authorities or the hosting provider in response to the identified threats. Despite this, the remaining risk is still considered high due to the potential for the domain to be reactivated or for similar domains to be registered in the future. It is recommended that users remain vigilant and avoid interacting with any similar-looking domains. Security teams should monitor for any reactivation and consider adding this domain to their blocklists to prevent future incidents.