jup-cku[.]pages[.]dev

This domain, jup-cku.pages.dev, presents an elevated-risk brand impersonation threat targeting users of Jupiter, a decentralized finance (DeFi) platform. Analysis indicates the site mimics the legitimate Jupiter interface, displaying the page title 'Jupiter | The DeFi Superapp | Jupiter' to deceive visitors into believing they are interacting with the official platform. Such impersonation typically aims to harvest wallet credentials, seed phrases, or deploy crypto drainer scripts, enabling unauthorized asset transfers from victims' wallets. The domain's infrastructure and visual design closely resemble Jupiter's branding, increasing the likelihood of successful social engineering attacks against crypto users seeking DeFi services. Evidence supporting the malicious classification includes detection by 1 of 95 security vendors on VirusTotal, a Gridinsoft trust score of 0 out of 100, and presence on one security blocklist. Infrastructure analysis reveals the domain was registered on April 27, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.76. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the site's legitimacy. The domain has since been taken offline, though its prior activity and registration details remain indicators of compromise for security teams monitoring similar threats. Users who visited jup-cku.pages.dev should immediately revoke any wallet connections or permissions granted to the site. If credentials or seed phrases were entered, affected wallets must be considered compromised; users should transfer assets to a new, secure wallet and monitor all connected accounts for unauthorized transactions. Security teams should add the domain and associated indicators (IP 172.66.44.76, registrar Cloudflare, Inc.) to blocklists and investigate potential lateral movement within networks. Historical DNS records and SSL certificate details may assist in identifying related infrastructure used in this campaign.