oquser[.]com

This domain is flagged for brand impersonation targeting Jupiter, a financial services platform. The site presents itself as an official Jupiter portal, using identical branding, page titles (Home | Jupiter), and layout to deceive users into entering sensitive credentials or downloading malicious payloads. Analysis indicates the site is designed to exploit trust in the Jupiter brand, potentially leading to account takeovers, financial fraud, or unauthorized access to personal data. The threat is particularly acute for users who may mistake the site for legitimate Jupiter services due to its polished appearance and familiar interface elements. Infrastructure analysis reveals the domain was registered on July 05, 2026, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. The site resolves to IP address 172.67.165.94 and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of security to visitors. As of the latest scan, 3 out of 95 security vendors on VirusTotal have flagged oquser.com as malicious, with detections including phishing, brand impersonation, and potential malware distribution. The domain's creation date, registrar choice, and hosting infrastructure align with patterns observed in coordinated phishing campaigns targeting financial platforms. Users who have visited oquser.com or entered credentials on the site should take immediate action to mitigate risks. First, terminate any active sessions and disconnect from the network to prevent potential malware from communicating with command-and-control servers. Next, change passwords for Jupiter accounts and any other services where the same credentials may have been reused, prioritizing financial and email accounts. Enable multi-factor authentication (MFA) wherever possible to add an additional layer of security. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to Jupiter's official support channels. If malware is suspected, perform a full system scan using updated security tools and consider restoring the device to a known clean state. Organizations should block the domain and IP address at the network level to prevent further access by employees or customers.