jup-dex[.]org

The domain jup-dex.org was registered through Porkbun LLC on February 19, 2025 and is currently offline. Infrastructure analysis shows the domain resolves to IP 213.209.129.90, which is hosted in the Netherlands under ASN 208185 (Net Gate Telecom S.R.L.). No TLS certificate is presented, indicating the site is served without encryption. The authoritative name servers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador., all belonging to the registrar’s network.

The page title returned by the server, "Jupiter DEX | Leading Decentralized Exchange on Solana | Jupiter Swap," directly references the Jupiter brand, confirming a brand‑impersonation tactic aimed at deceiving users of the legitimate Jupiter decentralized exchange. VirusTotal scans have flagged the domain in 15 of 95 security engines, and the domain appears on six public blocklists. AlienVault OTX has associated jup-dex.org with fourteen threat‑intelligence pulses, and the domain is listed as blocked by specialized anti‑phishing services including PhishDestroy, MetaMask, Polkadot, SEAL, and Enkrypt. These multiple independent detections reinforce the high‑risk classification.

While the site is presently taken offline, the infrastructure—particularly the hosting IP and the registrar’s name‑server set—could be reused for future malicious campaigns. Defenders should continue to monitor DNS resolution for this IP, enforce network‑level blocks for 213.209.129.90, and add jup-dex.org to domain‑allowlist exclusions in web‑filtering solutions. Ongoing threat‑intel feeds should be consulted for any re‑activation, and any user‑initiated connections to this domain should be treated as compromised. The combination of brand‑impersonation evidence, multi‑vendor detection, and blocklist inclusion justifies maintaining a high‑severity alert for jup-dex.org until the domain is permanently retired.