jupiter[.]coin-screener[.]xyz

This domain, jupiter.coin-screener.xyz, is identified as a high-risk brand impersonation phishing site targeting Jupiter, a cryptocurrency platform. Analysis indicates the domain was designed to deceive users by mimicking the legitimate Jupiter brand, likely to facilitate credential harvesting or crypto asset theft. No specific drainer kit signatures were observed in the available telemetry, but the infrastructure aligns with known phishing campaigns targeting decentralized finance (DeFi) users. The domain exhibits classic indicators of malicious intent, including the use of obfuscated subdomains and a lack of legitimate branding content, despite its targeted impersonation efforts. Infrastructure analysis reveals multiple concrete technical indicators supporting the phishing classification. The domain resolves to IP address 172.67.216.125, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin servers. It was registered on November 29, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. Google Safe Browsing explicitly flags the domain as phishing, and it appears on three security blocklists. VirusTotal reports 9 out of 95 security vendors detecting the domain as malicious, with no valid SSL certificate present to establish secure connections. The page title, '404 Not Found,' suggests the phishing content may have been removed or obfuscated post-detection, a tactic to evade automated scanners. As of the latest assessment, jupiter.coin-screener.xyz has been taken offline, likely in response to detection by multiple security entities, including PhishDestroy, MetaMask, and SEAL. While the immediate threat has been mitigated, residual risk remains due to the domain’s recent registration and the potential for infrastructure reuse. Users who may have interacted with the domain are advised to revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts. The absence of an SSL certificate further underscores the domain’s illegitimacy, as modern phishing sites typically employ SSL to appear credible.