jup-portal[.]org

This domain, jup-portal.org, is identified as a cryptocurrency-focused phishing portal designed to deceive users into disclosing wallet credentials or approving malicious transactions. Analysis indicates the site employs social engineering tactics, likely impersonating a legitimate cryptocurrency platform to facilitate wallet-draining attacks. No explicit brand spoofing is confirmed, but the domain name suggests an intent to mimic decentralized finance (DeFi) or token swap portals, a common vector for credential harvesting and asset theft in the crypto ecosystem. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain is flagged by 16 of 95 security vendors on a widely used threat intelligence platform, with a Gridinsoft trust score of 0/100. It resolves to the IP address 85.12.4.132, registered through a privacy-focused registrar, and is currently listed on four distinct security blocklists. Google Safe Browsing classifies the domain under SOCIAL_ENGINEERING, confirming its role in manipulative user interactions. The domain was served via Cloudflare, leveraging HTTP/3 for performance and potential evasion of traditional network-based detection mechanisms. Registration details indicate the use of a domain privacy service, obscuring ownership while maintaining operational infrastructure. As of the latest assessment, jup-portal.org has been taken offline, likely in response to detection by multiple security platforms and threat intelligence feeds. Despite its inactive status, residual risk persists due to the domain's prior resolution to a known malicious IP and its inclusion in two AlienVault OTX threat intelligence pulses. Users who interacted with the domain prior to its takedown may remain vulnerable to follow-on attacks, including credential replay or secondary phishing attempts. Organizations and individuals are advised to block the domain and IP at the network level, revoke any associated wallet approvals, and monitor for unauthorized transactions. Continuous vigilance is recommended, as threat actors frequently re-deploy similar infrastructure under new domains.