jupswap[.]pages[.]dev

The domain jupswap.pages.dev is flagged as a high‑risk crypto‑scam impersonating the Jupiter brand. Infrastructure analysis shows the domain resolves to IP address 172.66.47.116, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain was registered through Cloudflare, Inc. on March 06, 2026 and uses the Cloudflare nameservers igor.ns.cloudflare.com and lauryn.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate (WE1), confirming a valid SSL chain.

An HTTP request to the host returns a 403 status code, indicating access denial, but the page title returned by the server is "Suspected phishing site | Cloudflare," which aligns with the reported scam type of a crypto‑related phishing attempt. Google Safe Browsing classifies the site as social engineering, and Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis shows that 11 of 94 security vendors have flagged the domain, reinforcing the malicious assessment. The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

Although the site is currently taken offline, the combination of brand impersonation, confirmed SSL, hostile HTTP response, low trust score, and multiple vendor detections indicates a persistent threat. Defenders should continue to block the domain at DNS and firewall layers, monitor for any re‑registration or similar sub‑domains, and apply endpoint rules to prevent credential or wallet address harvesting attempts targeting Jupiter users. Ongoing vigilance is advised, as the underlying infrastructure (Cloudflare IP space) can host additional malicious actors.