mozilla-webstore-jupiterwallet-extension[.]pages[.]dev

This domain is flagged as a high-risk phishing infrastructure specifically targeting cryptocurrency wallet users through brand impersonation of Jupiter. The site mimics legitimate wallet extension pages to deceive victims into disclosing sensitive credentials, seed phrases, or private keys, enabling unauthorized access to digital assets. Analysis indicates the domain mozilla-webstore-jupiterwallet-extension.pages.dev was registered on April 04, 2026, through Cloudflare Pages infrastructure. It resolves to the IP address 188.114.97.3 and uses a Let's Encrypt SSL certificate (YE1). The page title, 'Jupiter Wallet | Secure Crypto Extension,' reinforces the impersonation attempt. Security vendors on VirusTotal flag the domain at a detection rate of 3/95, and it appears on at least one security blocklist. The domain remains active despite partial detection coverage, increasing the risk of successful exploitation. Mitigation requires immediate blocking of the domain and associated IP address across network security controls. Users should verify wallet extension authenticity by cross-referencing official project sources and avoiding third-party download links. Organizations should monitor for credential submissions to this domain and conduct internal awareness training on recognizing crypto wallet phishing tactics. Incident responders should preserve logs containing interactions with this infrastructure for forensic analysis and potential takedown coordination.