jup-dex-swap[.]mohimen[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Jupiter, a decentralized finance platform. Analysis indicates the site was designed to deceive users into interacting with fraudulent swap or transaction interfaces, likely to facilitate unauthorized asset transfers or credential harvesting. The infrastructure exhibits multiple indicators of malicious intent, aligning with known crypto drainer or phishing campaigns impersonating legitimate services. Infrastructure analysis reveals the domain jup-dex-swap.mohimen.com was registered on February 21, 2026, through Cosmotown, Inc. It resolves to IP address 104.234.134.14, hosted on AS40676 (Psychz Networks) in the United States. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer. Google Safe Browsing classifies it as phishing, while VirusTotal reports 14 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by Let’s Encrypt (R12), a common choice for both legitimate and malicious sites. The page title, 'Instant | Jupiter,' further suggests an attempt to mimic the branding and user experience of the legitimate Jupiter platform. Mitigation steps for this specific threat type include immediate blacklisting of the domain and associated IP address within enterprise and consumer security tools. Organizations should monitor for user interactions with the domain, particularly in environments where crypto transactions are common. End users should be educated to verify domain authenticity before connecting wallets or entering credentials, especially when prompted by unsolicited links. Given the domain’s current offline status, continuous monitoring for re-emergence or similar infrastructure is recommended. Security teams should correlate this activity with other known Jupiter impersonation campaigns to identify broader patterns or affiliated threat actors.