jupp-swap[.]sbs

PhishDestroy identifies jupp-swap.sbs as an active crypto drainer phishing domain designed to deceive users into authorizing malicious cryptocurrency transactions. The domain masquerades as a legitimate swap service, leveraging UI and branding similarities to exploit user trust and drain connected wallets. Security monitoring systems have classified this domain as elevated-risk due to active deployment and confirmed malicious intent.

This domain was flagged by 2 of 95 VirusTotal vendors, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 188.114.97.3. The domain was created on March 30, 2026, indicating recent activation within suspicious infrastructure. The low VirusTotal detection rate suggests evasive positioning, potentially targeting users unfamiliar with emerging crypto threats. The presence of a Let's Encrypt SSL certificate does not imply legitimacy, as threat actors frequently abuse free certificates for credibility masking.

Despite its active status, jupp-swap.sbs should be treated as a confirmed security threat. Users should avoid accessing the domain, interacting with any content, or entering wallet credentials. Security teams and researchers are advised to block the domain at the network level and report the IP to threat intelligence platforms. Continuous monitoring is recommended due to the domain’s recent registration and low initial detection rate. Exercise caution: domains with recent creation dates and low VT coverage often represent fast-evolving threats.