jupiter-nexus[.]app

The domain jupiter-nexus.app is a confirmed phishing site engaged in brand impersonation targeting users of the Jupiter cryptocurrency platform. It operated as a cryptocurrency scam designed to deceive victims into interacting with fraudulent interfaces, though no drainer kit was identified. As of the latest verification, jupiter-nexus.app has been taken offline, but prior activity posed an elevated risk to users.

Technical indicators confirm the malicious nature of jupiter-nexus.app. The domain was flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and SOCRadar, and appeared on 1 security blocklist (PhishDestroy). Registered through NiceNIC International Group Co., Limited on February 28, 2026, it resolved to the IP address 188.114.96.3, hosted on Cloudflare’s infrastructure (AS13335). The SSL certificate was issued by Let’s Encrypt (E7), and the observed page title was 'Un instant…'. Technologies detected included Cloudflare Browser Insights and HTTP/3, with nameservers pointing to Cloudflare’s DNS (rayne.ns.cloudflare.com and west.ns.cloudflare.com).

Victims of jupiter-nexus.app should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand’s security team to aid in takedown efforts. Monitor financial accounts for unauthorized transactions and consider reporting the incident to local cybercrime authorities.