eligible-jup[.]pw

This report details a malicious domain, eligible-jup.pw, identified as a cryptocurrency scam. The site displayed a "Just a moment..." page title, indicating a potential redirect or loading screen, but its core threat was impersonating the Jupiter brand to defraud cryptocurrency users. The primary risk involved credential theft or phishing, where victims might be tricked into connecting their wallets or revealing private keys, leading to financial loss.

Technical analysis confirms the threat. VirusTotal flagged the site with 12 out of 95 detections. It was identified by multiple security vendors including alphaMountain.ai, Certego, Cluster25, CRDF, and CyRadar, and appeared on 3 blocklists. The domain was registered on 2025-12-29 through PDR Ltd. d/b/a PublicDomainRegistry.com and hosted on IP address 104.21.55.108 in the United States, under AS13335 (Cloudflare, Inc.). It used an SSL certificate issued by Google Trust Services / WE1 and nameservers adi.ns.cloudflare.com and henrik.ns.cloudflare.com.

The domain is currently offline or down. Given its creation date, high detection rate, and confirmed impersonation of a cryptocurrency brand, the risk level for this specific domain is now low as it is inaccessible. However, the underlying threat pattern remains significant, and similar domains may be deployed in future campaigns.