jupiter-aggrgtor-auth-en[.]pages[.]dev

PhishDestroy identifies jupiter-aggrgtor-auth-en.pages.dev as an active brand impersonation domain targeting Jupiter users. The page purports to provide an ‘authentication endpoint’ but is a credential-harvesting trap designed to trick victims into surrendering account credentials under the guise of a legitimate Jupiter login flow.

This domain was flagged with status ‘active’ and risk level ‘under_investigation’. It resolves to IP address 188.114.97.3 and is hosted by Cloudflare, Inc. via Pages.dev. It carries a Google Trust Services SSL certificate, but VirusTotal currently shows 0 detections out of 95 engines. No public blocklist entries were found during initial checks, and creation date remains unverified in public WHOIS and passive DNS feeds.

Users should treat any unsolicited link to jupiter-aggrgtor-auth-en.pages.dev as suspicious and avoid entering credentials. Jupiter customers are advised to access accounts only via the official domain (jupiter.money or verified app portals) and enable multi-factor authentication. Report suspicious activity directly to Jupiter’s security team and local CERT. Block the domain and its resolving IP at network perimeter to prevent accidental exposure.