jupiter-wallet-download-io[.]pages[.]dev

jupiter-wallet-download-io.pages.dev was registered on 30 April 2026 via Cloudflare, Inc. The domain resolves to 172.66.47.65, a Cloudflare IP located in CA, and uses the nameservers leonard.ns.cloudflare.com and molly.ns.cloudflare.com. The site presents the page title “Jupiter Wallet Download — Secure Your Solana Assets Instantly” and is classified as a brand impersonation of Jupiter. The SSL certificate is issued by Google Trust Services under the WE1 authority, and the connection employs HSTS, HTTP/3, and Cloudflare edge protection, returning HTTP 200. Gridinsoft assigns a trust score of 0/100, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. The risk level is marked under_investigation and the status remains active. Analysis confirms that the infrastructure is typical of a malicious impersonation campaign targeting users of the Jupiter wallet service. No additional forensic artifacts such as malware hashes or payload delivery have been observed, and the page content has not been examined directly. The absence of detections on VirusTotal does not imply safety. Uncertainty remains regarding the specific phishing kit or credential collection mechanisms employed. Defenders should block the domain and its associated IP at network perimeters, monitor DNS queries for the domain and its Cloudflare nameservers, and apply URL filtering rules that match the observed page title. Continuous monitoring of any new detections on additional blocklists is advised, and any traffic to the site should be logged for further investigation.