jup[.]sol-flow[.]com

This domain, jup.sol-flow.com, operates as a crypto drainer phishing site impersonating Jupiter, a decentralized finance protocol. The site displays a page titled 'Jupiter l Christmas Distribution,' designed to deceive users into connecting wallets under the guise of a token airdrop or seasonal giveaway. The infrastructure is engineered to execute unauthorized transactions, draining cryptocurrency assets from victims' wallets upon interaction with malicious smart contracts or approval prompts. The use of a festive-themed distribution claim aligns with observed tactics to exploit heightened user engagement during holiday periods, increasing the likelihood of successful compromise. Analysis indicates the domain was registered on November 28, 2025, through MAT BAO CORPORATION, a registrar frequently associated with transient phishing infrastructure. The domain resolves to the IP address 172.67.130.224 and is flagged by 12 out of 95 security vendors on VirusTotal, reflecting moderate to high detection consensus. It appears on three independent security blocklists, and Google Safe Browsing classifies it under 'SOCIAL_ENGINEERING.' Additional technical indicators include a Gridinsoft trust score of 0/100, further corroborating its malicious intent. The domain has since been taken offline, though historical resolution and registration data remain accessible for forensic analysis. Users who visited jup.sol-flow.com or interacted with the 'Jupiter l Christmas Distribution' page should immediately revoke any wallet approvals granted during the session. This can be done using blockchain explorers or wallet management tools to inspect and revoke active smart contract authorizations. It is recommended to transfer remaining assets to a new, secure wallet address and monitor transaction histories for unauthorized activity. Affected users should also scan local devices for malware, as phishing sites may deploy secondary payloads. No further interaction with the domain or related communications should occur, and users are advised to verify all future airdrop claims through official Jupiter channels only.