jupiteget[.]xyz

This domain, jupiteget.xyz, is flagged for crypto credential harvesting phishing activity targeting cryptocurrency wallet users. Analysis of page content and infrastructure reveals a generic phishing framework designed to mimic legitimate wallet or exchange login interfaces, likely aimed at stealing seed phrases or private keys. The German-language page title 'Nur einen Moment…' suggests localization for European users, though no specific brand impersonation was confirmed in initial scans. No direct association with known drainer kits such as Angel Drainer or Inferno was observed, but the site employs standard evasion techniques including Cloudflare proxying and HTTP/3 support. Technical indicators confirm elevated risk: the domain is detected by 6 of 95 security vendors on VirusTotal, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 20, 2026, and resolves to IP address 188.114.96.3. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The domain appears on three security blocklists and is flagged by multiple cryptocurrency security platforms. HTTP Strict Transport Security (HSTS) is enforced, and the site is proxied behind Cloudflare, which obscures origin server details and complicates takedown efforts. No Google Safe Browsing (GSB) listing was recorded at the time of analysis. The domain is currently offline, likely due to hosting suspension or registrar intervention. Despite its inactive status, residual risk remains due to the potential for re-registration or migration to a new domain using the same infrastructure. Organizations and users are advised to block the domain and associated IP at the network level, monitor for related domains registered under the same registrar, and alert users who may have interacted with the site prior to takedown. Continuous scanning for credential reuse on other platforms is recommended, particularly for cryptocurrency-related services.