juice-finance-juice[.]org

Analysis indicates that juice-finance-juice.org is an active crypto scam domain impersonating the Across protocol, a decentralized finance (DeFi) platform. The domain was registered on October 10, 2025, through NiceNIC International Group Co., Limited, and remains operational as of July 12, 2026. Infrastructure analysis reveals resolution to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) with nameservers terry.ns.cloudflare.com and ximena.ns.cloudflare.com. The site presents itself under the page title 'Juice Finance: Leveraged Yield Farming on Ethereum DeFi Protocol,' directly targeting users familiar with DeFi yield farming services. The domain has been flagged by multiple security mechanisms, including MetaMask, PhishDestroy, and SEAL, and holds a trust score of 0/100. It appears on at least one security blocklist, and four of 95 security vendors on VirusTotal have detected malicious activity associated with this domain. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites leveraging legitimate certificate authorities to appear credible. Defenders should prioritize blocking this domain at the DNS and network level, particularly in environments where DeFi or cryptocurrency-related activities occur. The use of Cloudflare infrastructure is consistent with threat actor tactics to obfuscate origin servers and evade takedowns. While the exact content of the site has not been analyzed, the combination of brand impersonation, low trust scores, and detection by security vendors confirms its malicious intent. Further monitoring of related domains registered through the same registrar or resolving to the same IP range may uncover additional components of this campaign.