jupitercores[.]xyz

This domain, jupitercores.xyz, is actively engaged in brand impersonation targeting Jupiter, a decentralized finance platform. Analysis indicates the site is designed to deceive users into interacting with fraudulent smart contracts or disclosing wallet credentials, likely functioning as a crypto asset drainer. The domain mimics legitimate Jupiter branding, including visual elements and transactional prompts, to facilitate unauthorized transfers of digital assets. Infrastructure analysis reveals the following technical indicators: the domain is detected by 2 out of 95 security vendors on VirusTotal, with a presence on three independent security blocklists. It resolves to the IP address 172.67.138.241, hosted on infrastructure associated with a content delivery network in Canada. The domain was registered on May 17, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in malicious campaigns. The SSL certificate is issued by Let's Encrypt, providing a veneer of legitimacy while the domain remains unlisted on Google Safe Browsing. As of the latest assessment, jupitercores.xyz remains active and continues to pose a high risk to users. The domain has been preemptively blocked by multiple wallet security providers and threat intelligence feeds. Despite these mitigations, the infrastructure remains operational, and the registrar has not taken enforcement action. Users are advised to treat this domain as malicious, avoid interaction, and verify all transactions through official Jupiter channels. The persistence of the domain underscores the need for heightened vigilance in decentralized finance environments.