jupiter-swap[.]finance

Analysis indicates that the domain jupiter-swap.finance is actively impersonating Jupiter, a Solana-based decentralized exchange (DEX) aggregator, as part of a cryptocurrency scam campaign. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 172.67.222.167, which is associated with Cloudflare, Inc. (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (margot.ns.cloudflare.com and ezra.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which are common among both legitimate and malicious domains leveraging Cloudflare's infrastructure for obfuscation. The domain is flagged by one security vendor on VirusTotal and appears on a single blocklist, specifically PhishDestroy, which categorizes it as a brand impersonation threat. The HTTP status code 302 suggests the domain may be redirecting visitors to another location, though the final destination remains unconfirmed. The page title, 'Jupiter Swap: Best Rates & Low Fees | Solana DEX Aggregator,' directly mimics the branding and value proposition of the legitimate Jupiter platform, reinforcing the likelihood of fraudulent intent. While the domain's creation date is recent, it is not anomalous for 2026, and the use of Cloudflare does not inherently indicate malicious activity. However, the combination of brand impersonation, cryptocurrency scam classification, and detection by a security vendor warrants high-risk categorization. Defenders are advised to block or monitor traffic to this domain, particularly in environments where cryptocurrency transactions or Solana-based services are utilized. Further investigation into the redirect chain and associated infrastructure is recommended to identify additional threat vectors.