jup[.]ag-connect-api-walletv3[.]com

The domain jup.ag-connect-api-walletv3.com was registered on 21 February 2026 and is currently taken offline. Automated scans have recorded the page title as jup.ag-connect-api-walletv3.com, matching the domain string. Security telemetry classifies the site as a brand‑impersonation campaign targeting the cryptocurrency platform Jupiter, with the explicit intent of conducting a crypto‑related scam. Three of ninety‑three VirusTotal scanners raised detections, and the domain appears on two independent blocklists—PhishDestroy and ScamSniffer—both of which have listed it as malicious.

The Gridinsoft trust scoring system assigned a zero‑point rating (0/100), indicating a complete lack of trust. No additional infrastructure details such as registrar, IP address, hosting provider, or SSL certificate have been released in the available data, and safe‑browsing or OTX feeds do not contain further references. The limited evidence set confirms that the domain was used to masquerade as a Jupiter service, likely to lure victims into handing over cryptocurrency credentials or funds. Because the site is already offline, immediate containment actions focus on ensuring that internal DNS resolvers, proxy appliances, and endpoint protection suites block any resolution or HTTP request to the domain.

Security teams should also incorporate the domain and its known aliases into threat‑intel feeds and monitor for re‑registration or variations that reuse the “jup.ag‑connect‑api‑walletv3” naming pattern. Continuous review of detection signatures against the three VirusTotal vendor flags can improve early identification of similar campaigns. Until further infrastructure artifacts emerge, the primary recommendation is to keep the domain on blocklists, enforce network‑level deny rules, and alert users about unsolicited communications that reference Jupiter or request wallet access.