jup-swap[.]co

Analysis indicates that the domain jup-swap.co was registered on 2026-04-04 through Dynadot LLC and resolves to the IP address 176.125.242.151, which is hosted by Alexhost SRL in MD. The site serves content over HTTPS using a Let’s Encrypt R12 certificate and is delivered by an Nginx web server. The page title returned by the HTTP 200 response is “Jupiter Swap | Solana Exchange”, directly referencing the Jupiter brand and suggesting a fake exchange service. Google Safe Browsing classifies the domain under the SOCIAL_ENGINEERING category, and AlienVault OTX lists it in one threat‑intelligence pulse. VirusTotal reports that 17 of 94 scanning engines have flagged the domain, and Gridinsoft assigns a trust score of 0/100. The domain appears on three public blocklists and is actively blocked by multiple defensive feeds, including PhishDestroy, MetaMask, and SEAL. The high risk rating reflects its confirmed brand‑impersonation intent and the presence of a functional HTTPS endpoint that could be used to harvest credentials or lure victims into a fraudulent Solana‑based exchange. At present, no additional payload or malware artifacts have been observed, and the exact phishing workflow remains unverified. Defenders should add the IP 176.125.242.151 and the domain jup-swap.co to block lists, monitor DNS queries for the associated nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, and enforce strict validation of any Jupiter‑related URLs in user‑facing applications. Continuous threat‑intel feeds should be consulted for updates, and any traffic to the site should be logged and investigated for credential‑stealing attempts.