aswertwe4ty[.]pages[.]dev

PhishDestroy identifies aswertwe4ty.pages.dev as a live generic_phishing domain impersonating Jupiter, a leading Solana-based decentralized exchange. This page masquerades as Jupiter’s official platform under the title 'Jupiter - The Premier CEX Alternative on Solana', attempting to trick users into connecting wallets to a malicious drainer kit designed to siphon assets on the Solana network. While labeled as a generic phishing threat, the page’s behavior strongly suggests active deployment of a crypto drainer payload targeting SOL and SPL tokens.

Technical indicators confirm this domain’s malicious infrastructure. It resolves to IP 188.114.97.3 and is served via Cloudflare, Inc. with an SSL certificate issued by Google Trust Services. According to VirusTotal, the domain currently shows 0 detections out of 95 scanners as of the latest scan. The domain was flagged under seed 42df4f and remains under active investigation, though no blocklist entries or Google Safe Browsing (GSB) flags have been recorded yet. The registration path remains obscured behind Cloudflare’s proxy, limiting historical WHOIS visibility.

As of today, aswertwe4ty.pages.dev remains active and accessible. This domain poses a high risk to cryptocurrency users, particularly those engaging with Solana-based dApps. Immediate actions include blocking the domain at DNS and network levels and flagging the IP 188.114.97.3 for egress filtering. Users are strongly advised to verify any link purporting to be Jupiter or Solana-related by cross-checking against PhishDestroy’s real-time database before interaction. The current risk level is under investigation, but given the active drainer behavior and zero detections, this domain should be treated as HIGH RISK until further intelligence is gathered and shared across threat intelligence platforms.