treasury-jupiter[.]fun

This domain, treasury-jupiter.fun, poses an elevated risk as a brand impersonation threat targeting users of the Jupiter platform. Analysis indicates the site was designed to mimic legitimate Jupiter services, likely to deceive visitors into disclosing sensitive credentials, financial details, or installing malicious software. The domain’s infrastructure and content were structured to exploit trust in the Jupiter brand, potentially leading to account takeovers or unauthorized transactions if users engaged with the site. Infrastructure analysis reveals the domain was registered on December 13, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 104.21.77.194 and was flagged by 5 out of 95 security vendors on VirusTotal. The domain appeared on one security blocklist and was included in a single threat intelligence pulse on AlienVault OTX. The page title, 'Just a moment...,' suggests the use of evasion techniques to delay or obscure detection, a common tactic in phishing campaigns. Users who visited treasury-jupiter.fun should take immediate action to mitigate potential risks. Disconnect any devices used to access the site from networks and perform a full antivirus scan to detect malware. Reset passwords for any accounts accessed or credentials entered on the site, prioritizing financial or cryptocurrency-related platforms. Monitor accounts for unauthorized activity and enable multi-factor authentication where available. If financial information was disclosed, contact relevant institutions to report potential fraud and request account reviews. Avoid interacting with any communications linked to the domain, as follow-up attacks may occur.