swap-jupp[.]sbs

PhishDestroy identifies swap-jupp.sbs as an active crypto drainer domain designed to deceive users into connecting wallets for unauthorized token transfers. This domain specifically mimics JuiceboxDAO ecosystem projects, suggesting a targeted campaign against users familiar with the protocol. The threat type is classified as a generic phishing attack with elevated risk due to the active drainer kit functionality observed during analysis.

Technical indicators for swap-jupp.sbs include a VirusTotal detection score of 2 out of 95 security vendors, indicating limited but confirmed malicious activity. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 188.114.97.3. Registered on April 11, 2026, the domain uses a Let's Encrypt SSL certificate to appear legitimate. Google Safe Browsing (GSB) has not flagged this domain as malicious at this time, though blocklist monitoring shows emerging threat classification. The combination of recent registration and low VT detections suggests this is a newly deployed infrastructure actively participating in cryptocurrency theft operations.

Current status of swap-jupp.sbs remains active with ongoing hosting operations. Immediate response actions include domain takedown requests to hosting providers and IP blocking at network security layers. The elevated risk level persists due to the drainer kit's proven capability to trick users into wallet connections. Users should exercise extreme caution when encountering this domain or any JuiceboxDAO impersonation attempts. PhishDestroy recommends immediate domain blocking and wallet address verification before any transaction approvals. Remaining risk includes continued operation until infrastructure takedown occurs, with potential for domain rebranding or IP rotation to evade detection.