DNS/CDN/frontend hash drift

Evidence summary #

DNS/frontend hash drift signal (T-09 v1 phase 2; not production-live). Applicable to jup.ag primary frontend. Official jup.ag DNS/TLS posture: no confirmed changes detected via public cert transparency logs as of 2026-05-16 — official domain appears stable. However, two impersonator/typosquat domains confirm active threat actor interest in the Jupiter brand: (a) jup.ag-rewards.lat — registered 2026-03-11, mimicked official site title, currently offline; (b) jup-ag.live — low-risk crypto drainer, currently offline. These are F161 class (Cat 11), not F105 fires against the official domain. Scored yellow because: (1) typosquat activity is within the monitoring window and confirms elevated social engineering risk for the frontend surface; (2) the 2025-02-06 X account hack precedent shows Jupiter is an active high-value target for frontend/social engineering attacks; (3) a F105 monitoring baseline has not been established for jup.ag (change-management allowlist not documented). Official dom

Sources #

Methodology #

Detect whether the hash of production frontend JS changes versus the prior published hash, or a DNS config change is detected.

See the full factor methodology and distribution across all protocols →