jup-dex[.]pages[.]dev

This domain, jup-dex.pages.dev, is currently under investigation for brand_impersonation targeting the Across decentralized exchange platform. The domain presents itself as a Solana-based decentralized exchange (DEX) aggregator, a common tactic to deceive users into interacting with malicious smart contracts or disclosing sensitive credentials. As of the latest assessment, the domain remains active and unflagged by most security vendors, increasing its potential to evade detection. Analysis indicates the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. Despite its recent creation, the domain has already been added to one security blocklist, though it remains undetected by all 95 vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which may further reduce suspicion among end-users. The page title, 'Jupiter DEX - Solana Aggregator & Decentralized Exchange,' explicitly mimics branding associated with legitimate Solana-based platforms, enhancing its credibility. The current risk assessment categorizes this domain as active and under investigation due to its impersonation of a known decentralized finance (DeFi) brand. While no overt malicious payloads have been identified, the domain's infrastructure and branding suggest it is likely designed for credential harvesting, wallet-draining attacks, or fraudulent token swaps. Organizations and users are advised to block the domain at the network level and monitor for any interactions with it. End-users should verify the authenticity of DEX platforms by cross-referencing official documentation and avoiding unsolicited links. Security teams are encouraged to update detection rules to include this domain and its associated IP address in their threat intelligence feeds.