jupi-world[.]web[.]app

The domain jupi-world.web.app is actively engaged in brand impersonation, specifically targeting Discord, a widely used communication platform. Analysis indicates this is not a generic phishing attempt but a deliberate effort to exploit the trust associated with the Discord brand. The domain remains operational as of the latest verification, posing a significant risk to users who may mistake it for a legitimate service. Infrastructure analysis reveals the domain resolves to the IP address 199.36.158.100, hosted on AS54113 (Fastly, Inc.) in the United States. It is registered through Google Firebase and secured with an SSL certificate issued by Google Trust Services (WR4). The domain has been flagged by 12 of 95 security vendors on VirusTotal, and Google Safe Browsing has explicitly marked it as phishing. Additionally, it appears on two security blocklists, including PhishDestroy and ScamSniffer. The page title, 'Home | Jupiter,' does not align with Discord’s branding, further indicating malicious intent. Current status confirms the domain is still active, and users are advised to exercise extreme caution. Organizations should immediately block access to this domain at the network level, and end-users should avoid interacting with any content hosted on it. Security teams are recommended to monitor for similar impersonation attempts, particularly those leveraging Firebase hosting or Fastly IP ranges. If credentials or sensitive information have been entered on this site, immediate password resets and multi-factor authentication reviews are strongly advised.