jup-v3[.]pages[.]dev

jup-v3.pages.dev was registered on March 24, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.47.24 located in Canada. The site presents the page title “Swap | Jupiter,” directly referencing the Jupiter brand, and is classified as a brand impersonation campaign. Analysis of public blocklists shows the domain is listed on one security blocklist and has been actively blocked by the PhishDestroy sinkhole. SSL inspection reveals a certificate issued by Google Trust Services under the WE1 authority, confirming the use of a valid TLS chain despite malicious intent.

HTTP response code 403 indicates the server is currently denying access, and the domain status is reported as offline at the time of analysis. Detection services on VirusTotal flagged the domain in 11 of 94 scanners, reflecting a moderate detection rate for the observed infrastructure. The Gridinsoft trust score of 0 / 100 further underscores the malicious nature of the site. Technical fingerprints include enforced HSTS, Cloudflare CDN, and HTTP/3 support, all typical of fast‑flux hosting used for abuse.

Nameserver records point to ashley.ns.cloudflare.com and byron.ns.cloudflare.com, confirming Cloudflare’s role as the authoritative DNS provider. While the site is presently offline, the combination of brand‑specific page title, low trust score, multiple vendor detections, and blocklist entries provides sufficient evidence to label the domain as a confirmed brand‑impersonation threat targeting users of the Jupiter platform. Defenders should update web‑filter and DNS blocklists to include jup‑v3.pages.dev, monitor for any future re‑hosting on alternative IPs, and enforce user education about unsolicited “Swap” links claiming to originate from Jupiter. Continuous observation of Cloudflare‑associated IP ranges for similar impersonation patterns is also advised.