solsigma-ai[.]web[.]app

PhishDestroy has identified solsigma-ai.web.app as a high-risk threat actively engaging in brand impersonation of Jupiter, a well-known decentralized exchange aggregator. This domain is part of a phishing campaign targeting cryptocurrency users, likely attempting to steal wallet credentials or seed phrases. The page title found was "$SIGMA on Sol," which is unrelated to Jupiter but fits the typical lure of fake token airdrops or promotions designed to trick users into connecting their wallets.

Technical analysis reveals that solsigma-ai.web.app has a VirusTotal detection score of 7 out of 95 security vendors, indicating moderate but significant recognition as malicious. The domain is registered through Google Firebase and hosted on IP address 199.36.158.100, with an SSL certificate issued by Google Trust Services (WR4). It appears on two security blocklists, but its current status remains active. The domain's creation date was not provided, but given its active status, it is likely relatively recent.

As of this report, solsigma-ai.web.app is still accessible and operational, posing an ongoing risk to users who may encounter it through phishing emails, social media, or malicious ads. Users are strongly advised not to interact with this domain, enter any personal information, or connect any cryptocurrency wallets. If you have already done so, immediately transfer your assets to a new wallet and run a security scan on your device. PhishDestroy recommends reporting the domain to Google Safe Browsing and relevant blockchain security platforms to expedite takedown.