jupiter-swape[.]pages[.]dev

PhishDestroy identifies jupiter-swape.pages.dev as an active brand impersonation domain targeting Jupiter, a leading Solana-based DeFi platform. The domain leverages a fake swap interface—likely a drainer kit—to trick users into connecting wallets and signing malicious transactions. This threat falls under the category of 'brand impersonation,' specifically mimicking Jupiter’s official swap functionality to harvest private keys and tokens. The site is currently under investigation but remains accessible while analysts validate its malicious intent and payload structure.

Technical indicators confirm this domain’s malicious nature: VirusTotal shows 0/95 detections, indicating evasion of current antivirus signatures. It resolves to IP 172.66.44.211 and is registered through Cloudflare, Inc., which often obscures true ownership. The domain uses a Google Trust Services SSL certificate to appear legitimate. While creation date and full blocklist participation remain unverified, this site bypasses Google Safe Browsing (GSB) filters at this time. Its infrastructure aligns with known phishing campaigns targeting Solana users, where fake swap portals lead to unauthorized fund transfers.

The current status of jupiter-swape.pages.dev is 'active' with a risk level marked 'under_investigation.' Despite low detection scores, the domain’s clear intent to mimic Jupiter’s brand and UI suggests imminent malicious activity. Users should avoid interacting with this site and report any encountered transactions. Blocking at the network level is recommended where feasible. Remaining risk is moderate: while not yet flagged widely, threat actors may escalate operations. Immediate takedown is pending further forensic validation.