jup-fail-zxcjnzk[.]pages[.]dev

PhishDestroy identifies the active crypto drainer domain jup-fail-zxcjnzk.pages.dev, which mimics the Jupitor brand to siphon cryptocurrency from unsuspecting users. This impersonation leverages a generic drainer kit hosted on Cloudflare Pages, designed to deceive visitors into connecting their wallets under false pretenses. The infrastructure and payload appear tailored for quick deployment and evasion, with minimal footprint to delay detection. This domain resolves to 172.66.47.10 and is registered through Cloudflare, Inc. VirusTotal currently shows 5/95 detections, indicating it remains undetected by most antivirus engines. The SSL certificate issued by Google Trust Services lends superficial legitimacy, while the domain’s recent creation and Pages.dev hosting suggest a transient, disposable setup aimed at rapid deployment and evasion. No known blocklist entries exist at this time, highlighting the need for proactive blocking. The domain remains active and under investigation, with no detections yet on VirusTotal or blocklists. Immediate action is recommended: block the domain at DNS and network levels, monitor for related infrastructure, and alert users to avoid interaction. Remaining risk is high due to the unflagged status and active operation, posing a direct threat to cryptocurrency holders.