jup-portal[.]xyz

This domain, jup-portal.xyz, is flagged as a high-severity brand impersonation campaign targeting the Jupiter cryptocurrency platform. Analysis indicates the site presents a fraudulent rewards claim interface titled 'Jupiter Citizens · Claim your JUP rewards,' designed to deceive users into interacting with malicious smart contracts or disclosing wallet credentials. The infrastructure aligns with known crypto drainer operations, where victims are prompted to connect wallets to purported airdrop portals, resulting in unauthorized token transfers. Infrastructure analysis reveals the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IP address 188.114.96.3. Detection metrics show 9 of 95 security vendors on VirusTotal have classified the domain as malicious, while it appears on four independent security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common attribute in both legitimate and malicious domains. No creation date was provided, but the domain remains actively resolving and unblocked by Google Safe Browsing at the time of assessment. The campaign remains operational, with no evidence of takedown or sinkholing. Response actions by security entities include blocking by multiple wallet protection systems, though the domain continues to resolve. The remaining risk is elevated due to the active state of the site, its presence on public blocklists, and the targeted nature of the impersonation. Users are advised to verify domain authenticity through official channels, avoid interacting with unsolicited reward claims, and employ transaction simulation tools to inspect smart contract behavior before approval.