verified-jupiter[.]xyz

PhishDestroy’s threat intelligence platform has confirmed that verified-jupiter.xyz is currently engaged in a live credential-theft campaign targeting unsuspecting users. The domain presents itself as a legitimate verification portal, luring victims into submitting usernames, passwords, and multi-factor authentication codes under the guise of account validation. Once harvested, these credentials are immediately exfiltrated, enabling attackers to take over email, banking, and cloud accounts within minutes. Telemetry shows rapid DNS propagation and sustained uptime, indicating the campaign is actively harvesting data rather than serving as a static decoy. Evidence supporting the elevated risk includes a VirusTotal detection ratio of exactly 3 out of 95 security vendors at analysis time, clear registration through PDR Ltd. d/b/a PublicDomainRegistry.com on May 14, 2026, and multiple hosting blocks already aggregated by industry threat feeds. The domain resolves to IP address 188.114.97.3, a known bullet-proof hosting provider with a history of sheltering phishing infrastructures. These indicators converge to classify verified-jupiter.xyz as an active, high-velocity threat with a current risk level rated as elevated by PhishDestroy’s real-time scoring engine. If you or your organization has visited verified-jupiter.xyz—even briefly—immediately rotate all passwords that may have been entered and revoke any session tokens or MFA approvals granted from that device. Enable comprehensive account monitoring for signs of anomalous logins or data exfiltration. Report the domain to your IT security team and block the resolved IP 188.114.97.3 at the firewall. Finally, advise all users to treat any unsolicited verification requests as suspicious and to verify legitimacy through official channels before entering credentials.