guide-jupiter-swap-free[.]pages[.]dev

PhishDestroy identifies guide-jupiter-swap-free.pages.dev as an active brand-impersonation domain targeting Jupiter users. The page is loaded with a crypto drainer kit designed to harvest wallet credentials and siphon funds on transaction approval. This setup mirrors past Jupiter-themed campaigns that leverage fake swap interfaces to trick users into connecting malicious contracts. The domain resolves to 188.114.96.3, a Cloudflare range known for hosting short-lived crypto scams.

Technical indicators confirm the threat: VirusTotal reports 0 detections out of 95 engines (3/95), indicating the payload remains undetected by mainstream scanners. The domain was registered through Cloudflare, Inc. and holds an SSL certificate issued by Google Trust Services, which increases user trust and lowers suspicion. The page title “BlueWallet: The Maximalist's Bitcoin Standard - Self-Custody and PSBT Cold Storage” is unrelated to Jupiter and appears crafted to mislead crypto users searching for legitimate wallet solutions.

The domain remains active and unblocked by major threat intelligence feeds, placing users at immediate risk of fund loss. Cloudflare’s fast-flux hosting and short TTLs suggest the infrastructure is ephemeral, likely to evade takedowns. PhishDestroy flags this as a high-risk drainer with no current blocklist coverage. Users are advised to avoid the domain entirely and verify any Jupiter-related links using PhishDestroy’s real-time scanner. Remaining risk is high due to undetected payload and evasive infrastructure.