rewards-jupiter[.]xyz

This domain, rewards-jupiter.xyz, poses a high-risk brand impersonation threat targeting users of the Jupiter platform. The site mimics legitimate Jupiter reward claims, presenting a page titled 'Jupiter Citizens · Claim your JUP rewards' to deceive visitors into disclosing sensitive credentials or transferring assets. Analysis indicates the domain is designed to exploit trust in the Jupiter brand, likely aiming to harvest wallet credentials or distribute malicious payloads under the guise of token rewards distribution. The threat is particularly acute for users expecting legitimate airdrops or reward programs, as the site’s interface closely resembles official Jupiter communications. Infrastructure analysis reveals the domain was registered on June 01, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.97.3 and employs Cloudflare for hosting, a common tactic to obscure origin servers and evade detection. The domain appears on 3 security blocklists, and VirusTotal reports 16 out of 95 security vendors flagging it as malicious. Technologies detected include Node.js and Express for backend operations, alongside HTTP/3 for enhanced performance, which may also aid in bypassing traditional security measures. Users who visited rewards-jupiter.xyz should immediately revoke any connected wallet permissions and monitor accounts for unauthorized transactions. If credentials or private keys were entered, affected wallets should be considered compromised, and funds transferred to a new, secure wallet. Additionally, users are advised to scan their devices for malware, as the domain may have delivered secondary payloads. Given the domain’s current offline status, further interaction is unlikely, but vigilance is recommended for similar impersonation attempts targeting Jupiter or other cryptocurrency platforms.