jup[.]ag-alpha-dex-secure-gateway[.]cloud

The domain jup.ag-alpha-dex-secure-gateway.cloud is a cryptocurrency phishing site engaged in brand impersonation, specifically targeting users of the Jupiter platform. It presents itself as a legitimate gateway but is designed to deceive victims into disclosing wallet credentials or transferring funds to attacker-controlled addresses. No drainer kit has been identified, and the site is currently taken offline, though it previously posed a direct financial threat to cryptocurrency users.

Technical analysis shows jup.ag-alpha-dex-secure-gateway.cloud had 0 of 95 VirusTotal vendors flagging it as malicious, and Google Safe Browsing did not list it as unsafe. The domain appears on 1 security blocklist (PhishDestroy) and was created on 2026-02-21 07:01:08. It resolved to IP address 104.21.29.81, hosted by Cloudflare in the US, and used an SSL certificate issued by WE1. The observed page title was 'Instant | Jupiter', reinforcing its attempt to mimic the legitimate Jupiter service.

Users who interacted with jup.ag-alpha-dex-secure-gateway.cloud should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. Enable two-factor authentication on all accounts and monitor for unauthorized transactions. Report the domain to platforms like PhishTank, Google Safe Browsing, or local cybersecurity authorities to aid in broader takedown efforts.