jupiter-swap[.]org

This domain, jupiter-swap.org, poses a high-risk brand impersonation threat targeting users of the Jupiter Solana decentralized exchange (DEX). Analysis indicates the site mimics the legitimate Jupiter platform, presenting itself as 'Jupiter Exchange | Solana DEX | jup ag' to deceive visitors into entering sensitive credentials, such as wallet private keys or recovery phrases. The lack of an SSL certificate further increases the risk of interception during data transmission, while the domain's infrastructure is designed to exploit trust in the Jupiter brand for financial fraud or unauthorized asset transfers. Evidence supporting this assessment includes detection by 18 out of 95 security vendors on VirusTotal, registration through DYNADOT LLC, and a creation date of April 01, 2026, suggesting recent malicious intent. The domain resolves to the IP address 130.12.180.128, hosted by Virtualine Technologies in the Netherlands, and appears on three security blocklists, including PhishDestroy and MetaMask's threat intelligence feeds. The absence of SSL encryption and the domain's abrupt takedown further corroborate its fraudulent nature. Users who visited jupiter-swap.org should immediately revoke access to any connected wallets or applications, monitor transaction histories for unauthorized activity, and rotate credentials for associated accounts. If sensitive data was entered, affected parties should assume compromise and take steps to secure funds, such as transferring assets to a new wallet with a fresh seed phrase. Additionally, reporting the incident to relevant blockchain security teams and monitoring for further phishing attempts targeting Solana DEX users is advised.