helps-jupiter-us-io[.]typedream[.]app

This domain, helps-jupiter-us-io.typedream.app, is actively impersonating Jupiter, a known digital investment platform, and is classified as a high-risk brand impersonation threat. Analysis indicates the site presents itself as the legitimate Jupiter platform, using the page title 'Jupiter | Digital Investor Investment Platform,' which directly mirrors the branding of the targeted entity. The domain is hosted on Typedream, a platform often leveraged for rapid deployment of fraudulent sites, and currently resolves to the IP address 104.21.37.85. While the infrastructure appears to rely on cloud-based hosting, the specific autonomous system or geographic origin remains unconfirmed in available intelligence. Security vendors have flagged this domain with moderate consensus, as evidenced by detections from 4 out of 95 engines on VirusTotal. Additionally, the domain appears on three security blocklists and is actively blocked by multiple fraud prevention systems, including SEAL, MetaMask, and PhishDestroy. The SSL certificate is issued by Google Trust Services, which, while indicative of encrypted traffic, does not mitigate the malicious intent of the site. Gridinsoft has assigned a trust score of 0 out of 100, further corroborating the high-risk classification. Defenders should prioritize this domain for immediate mitigation, particularly within environments where Jupiter or similar financial platforms are utilized. The use of a subdomain under typedream.app suggests a pattern commonly observed in phishing campaigns, where attackers exploit legitimate hosting services to evade initial detection. While the exact phishing kit or payload remains unconfirmed, the combination of brand impersonation, active blocklist presence, and low trust scores provides sufficient evidence to warrant blocking at the network and endpoint levels. Monitoring for related domains under the same hosting provider or IP range may uncover additional threats in this campaign.