jup[.]ag-services-dex-api-auth[.]pro

The domain jup.ag-services-dex-api-auth.pro was registered on February 21, 2026 and is currently offline. It resolves to the Cloudflare address 104.21.88.220, an IP located in the United States and associated with ASN13335 (Cloudflare, Inc.). The site presents an SSL certificate identified as WE1, indicating that TLS was in use at the time of observation. Threat intelligence classifies the domain as a crypto scam that impersonates the Jupiter brand, and the page title returned by the server is "Access Denied," suggesting that the content is no longer reachable.

Security scanning on VirusTotal recorded 14 detections out of 95 participating vendors, providing moderate confidence that the domain is malicious. Independent blocklist monitoring shows the domain appears on a single security blocklist, and it has been explicitly blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of high risk. Defenders should add the domain and its resolving IP to deny lists at perimeter and endpoint controls, ensure that any existing firewall or DNS filtering solutions block traffic to 104.21.88.220, and monitor for other subdomains that share the "jup.ag-services-dex-api-auth.pro" suffix or similar naming patterns.

Continuous observation of Cloudflare‑hosted IP ranges for new registrations that target the Jupiter brand is advised, as threat actors frequently reuse such infrastructure. Organizations using Jupiter‑related services should alert users to the possibility of credential‑stealing attempts and enforce multi‑factor authentication where feasible. Incident response teams should retain the current detection metadata, including the 14 vendor flags, the 0/100 trust score, and the PhishDestroy block, for correlation with any future activity that may arise from this infrastructure.