jupiter-dex-ag[.]typedream[.]app

The domain jupiter-dex-ag.typedream.app was observed hosting a site titled “Jupiter DEX | Solana Exchange for Next‑Gen Crypto Trading”. The page title explicitly references the Jupiter brand, indicating a brand‑impersonation campaign aimed at deceiving users of the Jupiter cryptocurrency platform. The domain is registered through Typedream and resolves to IP 172.67.206.36, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. TLS is provided by Google Trust Services under the WE1 certificate, confirming a valid HTTPS connection despite malicious intent. An HTTP request returns status code 403, and the domain is currently listed as offline.

VirusTotal shows the domain has been scanned by 91 security vendors, none of which have reported a detection. The lack of detections does not constitute proof of safety. The domain appears on three blocklists—PhishDestroy, MetaMask, and SEAL—and is therefore already being filtered by multiple security products. Nameserver data is unavailable (NS_NOT_FOUND), limiting further DNS attribution.

Defenders should treat this indicator as a confirmed brand‑impersonation threat. Recommended actions include adding the domain to internal blocklists, ensuring web‑filtering and email‑security solutions reference the three blocklist entries, and monitoring traffic to the associated Cloudflare IP range for any resurgence. Continuous re‑evaluation is advised because the site may become active again; any change in status should trigger immediate alerts. Analysts should also monitor new Typedream subdomains that reference “Jupiter” or related cryptocurrency terminology, as the registrar may be reused for future campaigns.