jupag-dex[.]typedream[.]app

On July 23, 2026 analysts observed the domain jupag-dex.typedream.app serving a page titled “Jup DEX Aggregator on Solana and How”. The page title references a decentralized exchange aggregator on the Solana blockchain, yet the domain is listed as a brand‑impersonation case targeting the cryptocurrency brand Jupiter. The site returned HTTP 404 at the time of retrieval, and subsequent checks indicate the domain has been taken offline. Infrastructure analysis shows the domain resolved to IP 104.21.37.85, which belongs to Cloudflare (AS13335) and is geolocated in the United States.

The TLS certificate was issued by Google Trust Services under the WE1 leaf, confirming the use of a valid, publicly trusted certificate chain. The domain was registered through the Typedream website‑builder platform; nameserver information is unavailable (NS_NOT_FOUND). VirusTotal recorded the domain in 91 scans with no vendor flagging it, but the absence of detections does not constitute a safety guarantee. The domain appears on three independent blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that security vendors have already taken mitigation steps.

No additional artifacts such as malicious scripts, credential‑stealing forms, or download links have been publicly disclosed, and the current offline status prevents further content analysis. Defenders should continue to block the domain and its associated IP address at network perimeter and DNS layers, ingest the listed blocklist entries into existing detection pipelines, and monitor Typedream‑hosted domains for similar brand‑impersonation patterns. Ongoing observation of Cloudflare‑originating IP ranges for new domains mimicking Jupiter or other crypto projects is advisable. Because the site is no longer reachable, evidence collection is limited to the metadata described above; any future re‑appearance should be re‑evaluated with full content analysis.