web-jupiter-aggregator[.]pages[.]dev

This domain, web-jupiter-aggregator.pages.dev, is flagged as an active brand impersonation threat targeting Jupiter, a decentralized finance (DeFi) aggregator on the Solana blockchain. The page title, 'Jupiter Aggregator — Smart DeFi Trading on Solana,' closely mimics legitimate Jupiter interfaces, suggesting an intent to deceive users into interacting with fraudulent smart contracts or submitting wallet credentials. No specific drainer kit has been conclusively identified, but the domain’s structure and content align with known cryptocurrency phishing patterns designed to facilitate unauthorized token transfers. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.66.44.232, hosted on Cloudflare infrastructure in Canada. It was registered through Cloudflare, Inc., with a creation date of May 3, 2026, though this timestamp may reflect a placeholder or misconfiguration. On VirusTotal, the domain is flagged by 1 out of 95 security vendors, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), providing a veneer of legitimacy while obscuring the underlying malicious intent. No detection by Google Safe Browsing has been recorded at the time of analysis. As of the latest assessment, the domain remains active and accessible. While it is blocked by at least one security filter, the low detection rate across security platforms indicates a potential gap in coverage. Users are advised to avoid interaction with this domain, particularly those holding Solana-based assets. Organizations should consider adding the domain and associated IP to internal blocklists, and monitor for related subdomains or newly registered lookalike domains. The persistent risk underscores the need for real-time threat intelligence and proactive domain reputation checks in DeFi security protocols.