jup-portal[.]live

This domain, jup-portal.live, is identified as a high-risk phishing resource designed to impersonate a cryptocurrency portal interface. Analysis indicates the site likely operated as a credential harvester or crypto drainer, targeting users through social engineering tactics. While no explicit brand impersonation is confirmed, the domain name suggests an attempt to mimic legitimate cryptocurrency service portals, potentially exploiting users searching for wallet management or token swapping platforms. The infrastructure does not reveal a known drainer kit at this time, but the presence of Cloudflare and HTTP/3 suggests an effort to evade detection and enhance delivery speed. Technical indicators confirm the domain's malicious classification. The domain resolves to the IP address 188.114.97.3, a Cloudflare node commonly used to obscure origin servers. It was registered through PublicDomainRegistry, a registrar frequently associated with abusive domains. Google Safe Browsing has flagged the domain with the label SOCIAL_ENGINEERING, and it appears on four security blocklists. VirusTotal reports 13 out of 95 security vendors detecting the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. AlienVault OTX includes the domain in two threat intelligence pulses, further corroborating its association with active phishing campaigns. As of the latest assessment, jup-portal.live has been taken offline, likely in response to detection and blocking by multiple security mechanisms. The domain is currently blocked by at least four independent detection systems, including wallet protection tools and DNS-based threat feeds. Despite its offline status, residual risk remains due to potential cached DNS entries or archived copies of the phishing page. Users who may have interacted with the domain are advised to revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations are recommended to update blocklists with the domain and associated IP to prevent future access attempts.