jup-ag[.]gd

This domain is flagged as a high-risk brand impersonation threat specifically targeting Jupiter, a decentralized exchange (DEX) platform. Analysis indicates the site operates as a crypto drainer, leveraging fake DEX interfaces to deceive users into connecting wallets and authorizing malicious transactions. The impersonation tactic is designed to exploit trust in the Jupiter brand, presenting itself as a legitimate swap platform to facilitate unauthorized fund transfers. Infrastructure analysis reveals multiple technical indicators of compromise. The domain jup-ag.gd was registered on March 04, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 130.12.180.128 and is detected by 13 out of 95 security vendors on VirusTotal. The site is blocked by MetaMask, PhishDestroy, and SEAL, and appears on three security blocklists. Additional technical data includes a Gridinsoft trust score of 0/100 and the use of PHP, Nginx, and OpenResty technologies. The page title, 'Jupiter Exchange: The Leading Jupiter DEX for Optimal Swaps,' directly mimics legitimate Jupiter branding to enhance credibility. Mitigation against this brand impersonation threat requires immediate action from both users and security teams. Users should verify domain authenticity by cross-referencing official Jupiter communication channels and avoiding any interaction with jup-ag.gd. Wallet providers are advised to enforce strict blocklist policies, particularly for domains registered through high-risk registrars like NiceNIC International Group Co., Limited. Security teams should monitor for similar impersonation patterns, including lookalike domains, unusual PHP-based DEX interfaces, and IP ranges associated with 130.12.180.128. Transaction simulation tools can help detect crypto drainer activity by identifying unauthorized swap approvals or fund transfers to unfamiliar addresses. Proactive DNS filtering and real-time phishing detection mechanisms are recommended to prevent access to this domain and its associated infrastructure.