xjup[.]pages[.]dev

The domain xjup.pages.dev was observed targeting the Jupiter brand by presenting a page titled "Jupiter - The Premier CEX Alternative on Solana". The site was registered on March 03, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned IP address 172.66.44.200 located in the United States (AS13335). DNS resolution uses the Cloudflare nameservers jermaine.ns.cloudflare.com and jo.ns.cloudflare.com. The server presents a valid SSL certificate issued by Google Trust Services (WE1) and enforces HSTS while supporting HTTP/3, indicating a modern web stack. An HTTP request returned status code 403, and the domain is currently taken offline.

Multiple security products have flagged the domain. PhishDestroy, MetaMask, and SEAL have listed it on blocklists, and it appears on three additional public blocklists. Google Safe Browsing classifies it as a social engineering threat. VirusTotal scans show that 11 of 94 security vendors label the domain as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment.

The identified scam type is "Wallet/Seed Phishing", consistent with the impersonation of the Jupiter brand. Analysis indicates that the infrastructure is typical of a Cloudflare‑proxied phishing campaign, leveraging a legitimate‑looking TLS certificate to increase credibility. The exact page content has not been captured, so the specific techniques used to harvest wallet seeds remain unknown. Defenders should block the domain and its underlying IP at network perimeters, monitor DNS queries for the domain and its Cloudflare nameservers, and add the host to endpoint and browser protection allow‑lists that already contain it. Continuous re‑evaluation is advised in case the site is re‑hosted on a different IP or re‑registered under a new domain.