jup[.]ag-api-connect-v2-wailet[.]live

The domain jup.ag-api-connect-v2-wailet.live was registered on February 21, 2026 and is currently taken offline. Analysis of public records shows that the site presented the page title "Instant | Jupiter," indicating an attempt to impersonate the Jupiter brand. The page was classified as a crypto‑related scam, consistent with the reported scam type. The domain resolves to the IPv6 address 2606:4700:3031::ac43:aa1d, which is associated with Cloudflare, Inc. (AS13335) and geolocated to the United States.

The SSL certificate presented on the site is identified as WE1, confirming that transport encryption was in place at the time of observation. VirusTotal scanned the domain and recorded a single positive detection out of ninety‑five security vendors, suggesting limited but notable malicious activity. The domain has been added to at least one external blocklist and was specifically blocked by the PhishDestroy service, reinforcing its classification as malicious. No additional intelligence such as Safe Browsing status, Open Threat Exchange entries, or registrar details were available in the supplied data.

The limited detection footprint and single blocklist entry indicate that the campaign may have been short‑lived or targeted a narrow audience before being taken down. Defenders should continue to monitor Cloudflare‑hosted IPv6 ranges for similar impersonation patterns, enforce domain‑based allowlists that exclude this exact FQDN, and update endpoint protection signatures to reflect the observed VirusTotal detection. Because the site is offline, active takedown actions are no longer required, but threat‑intel sharing of the domain, IP address, and SSL fingerprint is recommended to aid correlation with future campaigns that may reuse the same infrastructure.