jupiter-jup-staking-5f79[.]bolt[.]host

Analysis of jupiter-jup-staking-5f79.bolt.host indicates a high‑risk brand‑impersonation campaign targeting users of the Jupiter cryptocurrency platform. The domain was registered on November 14, 2024 through Cloudflare, Inc., and resolves to the IP address 172.67.75.9, which belongs to AS13335 Cloudflare in the United States. The hosting infrastructure is protected by Cloudflare, as reflected in the detected technologies and in the SSL certificate issued by Google Trust Services (WE1), suggesting the site leveraged legitimate TLS to increase credibility. The page title, “Is staking $JUP since day one worth it?”, directly references the Jupiter token, reinforcing the impersonation intent.

Google Safe Browsing classifies the site as social engineering, and PhishDestroy has listed it on its blocklist; the domain also appears on a single additional security blocklist. VirusTotal reports that 13 of 95 scanners flagged the domain, indicating a modest but notable detection rate. An HTTP 403 response was observed, and the site is currently offline, as noted by the status “taken offline”. Uncertainty remains regarding the exact payload delivered to visitors, as the page content has not been captured beyond the title.

No evidence of additional malicious infrastructure such as command‑and‑control servers or credential‑harvesting endpoints is available. Defenders should block the domain at network perimeters and DNS filters, monitor for any traffic to the associated Cloudflare IP, and consider adding the domain to internal threat‑intel feeds. Continuous re‑evaluation is advised in case the operator re‑activates the domain or deploys similar sub‑domains using the same hosting pattern.