jup-gateway-sol[.]pro

Analysis of the domain jup-gateway-sol.pro indicates a high-risk crypto scam targeting Ethereum users, currently offline as of July 23, 2026. The domain was registered on March 3, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with fraudulent activity. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers rick.ns.cloudflare.com and surina.ns.cloudflare.com, resolving to IP 188.114.97.3 in the US. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites, offering no inherent trust signal. Security vendor detections show 14 of 94 engines on VirusTotal flagging the domain, alongside a single blocklist entry from PhishDestroy.

Google Safe Browsing classifies the site as social engineering, a designation typically applied to phishing or deceptive content. The page title 'Buy' suggests a transactional focus, consistent with crypto scam patterns, though the exact content remains unanalyzed. Detected technologies include Node.js, Chart.js, Vue.js, Nuxt.js, and third-party CDNs (jsDelivr, cdnjs), which are legitimate tools but commonly exploited in scam infrastructure to mimic professional platforms. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification.

While the domain is currently offline, defenders should treat any reactivation as a critical threat. Organizations are advised to block the domain, IP 188.114.97.3, and associated Cloudflare nameservers at the perimeter. Ethereum users and wallet providers should monitor for references to jup-gateway-sol.pro in transaction histories or phishing reports. Given the domain's short lifespan and rapid detection by security vendors, further monitoring of related infrastructure (e.g., newly registered domains under the same registrar or ASN) is recommended to preempt copycat threats.