connect-pinksale[.]pages[.]dev

The domain connect-pinksale.pages.dev is a confirmed phishing site engaged in brand impersonation targeting the Jupiter platform. It was designed to deceive users into connecting their cryptocurrency wallets under the pretense of a legitimate Jupiter service, posing an elevated risk of credential theft or unauthorized transactions. No drainer kit was identified, but the site operated as a wallet-connect phishing page. As of the latest verification, connect-pinksale.pages.dev has been taken offline.

Technical indicators confirm the malicious nature of connect-pinksale.pages.dev. The domain was flagged by 2 of 95 VirusTotal security vendors, including Gridinsoft (trust score 0/100) and Trustwave. It appears on two security blocklists, PhishDestroy and ScamSniffer, and was registered through Cloudflare, Inc. on September 04, 2025. The site resolved to IP address 172.66.46.210 (US, AS13335 Cloudflare, Inc.) and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'Instant | Jupiter', and the domain employed technologies such as HSTS, Cloudflare, and HTTP/3. At the time of assessment, the site returned an HTTP 403 status code.

Users who interacted with connect-pinksale.pages.dev should immediately revoke any token approvals granted to the site via their wallet interface and transfer funds to a new, secure wallet. Monitor transaction history for unauthorized activity and enable two-factor authentication on all accounts. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand (Jupiter) to assist in broader mitigation efforts.