jupiter-exchange-en-eng[.]pages[.]dev

This domain, jupiter-exchange-en-eng.pages.dev, is identified as a high-risk brand impersonation threat targeting Jupiter, a Solana-based decentralized exchange (DEX). The page mimics Jupiter’s official interface, using the title 'Jupiter Exchange | The Ultimate Solana DEX for Smarter Crypto Swaps' to deceive users into interacting with fraudulent crypto swap or wallet-draining mechanisms. No specific drainer kit has been confirmed, but the domain’s structure and content align with known crypto phishing tactics, including fake login prompts or malicious smart contract interactions. Analysis reveals the following technical indicators: the domain is flagged by 3 out of 95 security vendors on VirusTotal, with detection likely tied to its fraudulent branding. It is registered through Cloudflare, Inc., resolving to the IP address 188.114.96.3, geolocated to Cloudflare’s infrastructure in Canada. The domain was created on April 30, 2026, an anomalous future date suggesting potential obfuscation or misconfiguration. It appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites. The domain remains active as of the latest verification, posing a continued risk to users. Response actions include its inclusion in at least one blocklist and partial vendor detection, though coverage remains limited. The anomalous creation date and Cloudflare hosting may hinder takedown efforts. Users are advised to verify domain authenticity via official Jupiter channels, avoid interacting with unsolicited links, and employ wallet transaction simulation tools to detect potential drainer activity before signing. Organizations should monitor for similar impersonation patterns using the observed IP and registrar as pivot points.