rewards-jup-ag[.]xyz

The domain rewards-jup-ag.xyz is identified as a brand impersonation threat targeting Jupiter, a decentralized finance platform. Analysis indicates the domain was designed to mimic an Active Staking Rewards (ASR) program for the period January to March 2026, a tactic commonly employed to deceive users into disclosing sensitive credentials or transferring assets under false pretenses. As of the latest assessment, the domain has been taken offline, though it remains a documented case of fraudulent activity in the cryptocurrency ecosystem.

Infrastructure analysis reveals the domain was registered on June 06, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. Detection metrics show the domain was flagged by 1 of 95 security vendors on VirusTotal, while Gridinsoft assigned it a trust score of 0/100. The domain appears on three security blocklists and was actively blocked by multiple threat intelligence platforms, including MetaMask and PhishDestroy. AlienVault OTX records indicate its presence in two distinct threat intelligence pulses, further corroborating its malicious classification. Technological fingerprinting detected the use of Cloudflare and HTTP/3, infrastructure choices that may have been leveraged to obfuscate the origin and evade detection.

Given its current offline status, rewards-jup-ag.xyz no longer poses an immediate active threat. However, users who may have interacted with the domain prior to its takedown are advised to revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators of compromise. Security teams are encouraged to review logs for connections to the domain, particularly during its active period, to assess potential exposure. Proactive measures, such as user education on recognizing brand impersonation tactics, remain critical in mitigating similar threats.