jupsol[.]me

This domain, jupsol.me, is flagged as a brand impersonation threat targeting Jupiter, a decentralized finance platform. Analysis indicates the site mimics Jupiter’s official interface, presenting itself as 'Jupiter | The DeFi Superapp | Jupiter' to deceive users into connecting wallets or entering sensitive credentials. The threat type aligns with known wallet-draining campaigns, where attackers exploit fake DeFi portals to siphon funds from unsuspecting victims. Infrastructure analysis reveals the domain was registered on February 22, 2026, through Squarespace Domains LLC, a registrar frequently abused for short-lived malicious domains. It resolves to the IP address 104.21.48.30, hosted behind Cloudflare, which is commonly leveraged to obscure server origins and evade takedowns. The domain is detected by 3 out of 95 security vendors on VirusTotal, with a presence on three distinct security blocklists. Technologies such as HTTP/3 were identified, suggesting an attempt to appear legitimate while maintaining operational efficiency for malicious purposes. As of the latest assessment, jupsol.me has been taken offline, likely due to enforcement actions by security providers or hosting interventions. However, residual risk persists, as threat actors may re-deploy the domain or shift infrastructure to new addresses. Users who interacted with the site should revoke wallet permissions, monitor for unauthorized transactions, and verify future interactions with the legitimate Jupiter platform via official channels. Organizations should update blocklists to include this domain and its associated indicators to prevent recurrence.