vote[.]jupag[.]app

vote.jupag.app impersonates the cryptocurrency brand Jupiter, aiming to deceive users into divulging sensitive information. The domain, registered with Web Commerce Communications Limited, lacks an SSL certificate, a common trait in phishing sites to avoid detection. Despite being offline now, it was flagged by PhishDestroy and one VirusTotal vendor, highlighting its malicious intent.

The domain's creation on February 21, 2026, and detection by PhishDestroy just five days later, underscores the rapid deployment typical in phishing campaigns. This quick turnaround exploits the window before antivirus databases update, allowing the scam to operate under the radar. The platform risk score of 56/100 further indicates moderate threat potential, despite its current offline status.

Hosted on IP 216.245.184.94 in the US, under ASN AS399629 BL Networks, vote.jupag.app was designed to mimic legitimate Jupiter operations, likely to harvest cryptocurrency credentials. The presence of one public blocklist entry, specifically by PhishDestroy, and a single VirusTotal detection, reflects the site's brief operational period before being taken down. This case exemplifies the importance of early detection in mitigating phishing threats.