jupiteragg[.]co[.]com

PhishDestroy identifies jupiteragg.co.com as a fraudulent domain actively impersonating Jupiter, a legitimate cryptocurrency exchange platform, to deceive users into transferring funds to attacker-controlled wallets. The site leverages social engineering tactics, including brand imitation and false investment opportunities, to trick victims into engaging with malicious smart contract drainer kits designed to siphon cryptocurrency assets. This domain is part of a broader campaign targeting unsuspecting users by exploiting Jupiter’s reputation in the crypto space.

Technical analysis reveals critical indicators of compromise: the domain resolves to IP address 23.172.217.229 and is flagged by 9 out of 95 security vendors on VirusTotal, indicating significant but not universal detection. Registrar data shows this domain was created recently, though the exact creation date is not publicly disclosed. Google Safe Browsing has classified jupiteragg.co.com as a SOCIAL_ENGINEERING threat, further validating its deceptive intent. The domain utilizes a Let’s Encrypt SSL certificate, which may lend an air of legitimacy to casual observers, while its infrastructure and behavior align with known cryptocurrency drainer operations.

As of the latest assessment, jupiteragg.co.com remains active and poses an elevated risk due to its impersonation of Jupiter and the presence of drainer infrastructure. Immediate user action is advised: avoid interacting with this domain or any linked platforms, and verify the authenticity of any communications purporting to represent Jupiter through official channels. Users who have already engaged are urged to disconnect wallets, revoke suspicious smart contract approvals, and report the incident to Jupiter’s official support. While the domain remains accessible, ongoing monitoring and collaborative blacklisting efforts are critical to mitigate further victimization. Remaining risk remains high as long as the domain stays online and active.