guide-jupiter-swap-helps[.]pages[.]dev

This domain, guide-jupiter-swap-helps.pages.dev, is actively engaged in brand impersonation targeting the Across protocol, a cross-chain bridging platform. The site presents itself as a legitimate JupiterSwap interface, using the page title 'JupiterSwap | Spot Swaps, Perps & JLP Lending on Solana' to deceive users into interacting with malicious smart contracts or disclosing sensitive credentials. As of the latest analysis, the domain remains operational and unmitigated, posing a high risk to users unfamiliar with the authentic Across or JupiterSwap services. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 16, 2025, and currently resolves to the IP address 172.66.47.161, geolocated within the United States under AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common configuration for phishing sites leveraging Cloudflare’s hosting infrastructure. Detection metrics indicate the domain is flagged by 3 of 95 security vendors on VirusTotal, while only one security blocklist currently includes it in their denylists. The low detection rate suggests the campaign may still be in an early or evasive phase, reducing visibility among automated scanning systems. The current status of guide-jupiter-swap-helps.pages.dev remains active, with no evidence of takedown or remediation. Users are advised to exercise extreme caution when encountering this domain, particularly in contexts involving cryptocurrency transactions or wallet connections. Verification of the official Across protocol domains and cross-referencing with trusted community sources is strongly recommended. Network defenders should update blocklists to include this domain and its associated IP, while monitoring for additional indicators of compromise linked to this campaign.