jlp[.]ag

On July 24, 2026, a domain named jlp.ag was identified as a brand impersonation threat targeting Raydium, a known cryptocurrency platform. The domain was registered through Dynadot LLC on March 4, 2026, and was subsequently taken offline. The page title of the domain was 'Swap Raydium', indicating an attempt to deceive users into believing they were interacting with a legitimate Raydium service. The domain resolves to the IP address 104.21.9.161, which is located in the United States and is associated with Cloudflare, Inc. (ASN13335).

The domain does not have an SSL certificate, which is a common characteristic of malicious sites as it reduces the level of trust and security for users. Analysis indicates that the domain has been flagged by three security blocklists: PhishDestroy, MetaMask, and SEAL. These blocklists are known for identifying and mitigating crypto scams, which aligns with the classification of this domain as a crypto scam. Despite the domain being offline, it is important for defenders to remain vigilant and ensure that any residual infrastructure or related domains are monitored and blocked.

The lack of an SSL certificate and the presence of the domain on multiple blocklists are strong indicators of its malicious intent. Defenders should also consider the possibility that the threat actors may attempt to re-register or use similar domains in the future. The exact content of the page was not analyzed, but the page title and registration details provide sufficient evidence of the impersonation attempt. Security teams should update their threat intelligence databases and ensure that users are informed about the risks associated with this domain and similar threats.