impdemowell[.]xyz

This domain, impdemowell.xyz, is actively engaged in cryptocurrency airdrop phishing, specifically impersonating the Jupiter platform. The site presents itself as a legitimate airdrop distribution point, a common tactic used to deceive users into connecting wallets or divulging private keys. Analysis confirms the domain is currently operational and hosting malicious content designed to facilitate unauthorized asset transfers, commonly referred to as crypto drainers. Infrastructure analysis reveals the domain was registered on June 22, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which has been flagged in multiple threat intelligence feeds. Security vendors on VirusTotal have detected the domain, with 4 out of 95 engines classifying it as malicious. Additionally, the domain appears on four distinct security blocklists, including those maintained by MetaMask, PhishDestroy, SEAL, and InversionDNS. The page title, 'Jupiter | Airdrop,' directly references the targeted brand, reinforcing the impersonation strategy. Google Safe Browsing has also marked the domain with a 'SOCIAL_ENGINEERING' classification, indicating its use in deceptive practices. The domain poses a high risk to users, particularly those involved in cryptocurrency transactions. Current indicators suggest the infrastructure remains active and capable of deploying further malicious payloads. Immediate mitigation steps include blocking the domain and associated IP at the network level, as well as adding it to endpoint protection rules. Users are advised to verify the authenticity of any airdrop-related communications through official channels and refrain from interacting with unsolicited links or wallet connection prompts. Organizations should monitor for related indicators of compromise, including the IP address and registrar details, to prevent potential breaches.