jup-exchange[.]sbs

Domain jup-exchange.sbs has been flagged for brand impersonation targeting the Jupiter cryptocurrency platform. This domain is suspected to host a crypto drainer kit designed to siphon funds from unsuspecting users by mimicking Jupiter’s official exchange interface. The threat remains under active investigation to determine the full scope of malicious functionality, including whether the drainer uses clipboard manipulation, fake wallet connectors, or phishing overlays. PhishDestroy identifies jup-exchange.sbs as resolving to IP address 188.114.97.3 with a VirusTotal detection score of 2/95 engines, indicating it has not yet been widely flagged despite its malicious intent. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, and currently holds a valid Let's Encrypt SSL certificate. It has not been added to Google Safe Browsing (GSB) and remains absent from major blocklists, highlighting a critical window for proactive takedown or user awareness. As of this report, jup-exchange.sbs remains active with an under_investigation status, posing an emerging risk to users searching for Jupiter-related services. Response actions may include domain takedown requests, IP-based blocking, and updating threat intelligence feeds. While current risk is elevated due to the lack of detection coverage, users are strongly advised to verify any Jupiter-related links using PhishDestroy and avoid direct interactions with jup-exchange.sbs until its status is clarified.