GBHackers — 670 Jev Domains Registered After Launch as Fake AI Marketplaces Target Users (2026-09-28)

Mayura Kathir, GBHackers, 28 September 2026. Reports Eye Security's investigation, "Rise of the Jev Clones," into a domain-squatting wave that followed TypeSafe AI's Jev launch — the same launch the sibling ../llm-providers-wiki spoke already holds from the vendor side (see its page there).

T3 — trade press relaying one investigator's findings, the same shape as infoq-agent-vm-escape: no second source, no independent check of Eye Security's counts. The primary "Rise of the Jev Clones" report itself is not held here, only this summary of it.

What happened

TypeSafe launched Jev, a "System One" typed-decision model, on 15 September 2026. Within eight days — by 22 September — about 670 domains containing "jev" had picked up TLS certificates, roughly 170 of them registered on 18 September alone, the same day Eye Security says it found the first clone storefronts. A parallel wave targeted the vendor's own name: about 40 new "typesafe" domains appeared 16–21 September.

Three named clones — jev-ai[.]pro, jev-agent[.]org, jevtypesafeai[.]com — run as unofficial resellers. They hold no model of their own; they forward every prompt to TypeSafe's real API and charge customers 6 to 11.5 times the official rate ($0.042 per million input tokens, output free), while routing those prompts — which can carry source code or business data — through a server the customer never agreed to trust. Eye Security traced a six-site network (including two of the three named clones plus lyria35[.]pro, h3maxturbo[.]pro, faceless-reels[.]pro, taomateh3[.]pro, laya-ai[.]pro) sharing Namecheap registration, Cloudflare fronting, and identical JavaScript and site identifiers — one operator running a repeatable template, not six independent scams.

Technique inventory

SEO manipulation — jev-ai.pro outranked typesafe.ai itself on a search for "Jev AI."
Convincing storefronts — API docs, a playground, pricing tiers, a checkout flow: everything a buyer expects from a real vendor.
Pressure sales tactics — 50%-off annual pricing, welcome credits, daily check-in rewards, a countdown timer that resets every day.
Buried disclaimers — a non-affiliation notice exists on some sites, but in a footer or a legal page, not at the point of purchase.
Backdated legal pages — effective dates earlier than the domain's own registration date; on one site the dates changed while Eye Security was still investigating it.
Repeatable playbook — spot a trending launch, register a keyword-heavy domain, clone a generic storefront, wire it to the real API, add a markup.

What the source does not establish

Domain registration alone is not evidence of a scam — the article itself says guides, demos, community projects and parked domains inflate the same count. The 670 and 40 figures are a surge signal, not a headcount of confirmed clones; three domains carry confirmed pricing/proxy evidence, the rest are unclassified. No victim count, no dollar-loss figure, and no detail on how the six-site network's operator was identified beyond the shared-infrastructure fingerprint.

Recommendations (from the source)

Use Jev only through typesafe.ai / console.typesafe.ai, or an established gateway (OpenRouter, Vercel AI Gateway, Cloudflare AI Gateway); verify a vendor link from an official announcement, not a search result; check a domain's registration date and first-seen certificate date before trusting it; compare pricing against the vendor's own published rate; treat an intermediary with no clear legal entity, security documentation, retention policy or SLA as a supply-chain and data-governance risk.

Cross-spoke context

Runner-up: ../osint-wiki. The campaign's attacker side — watching for a trending launch and registering a keyword-heavy domain within hours of it — is reconnaissance tradecraft, the offensive mirror of the defender/user-protection framing kept here. It is the same split synthesis already records between this spoke and ../osint-wiki over google-beyond-zero and autonomous-pentesting (2026-07-27). No page in ../osint-wiki names this campaign as of this ingest; recorded here per the router's note, not written into that spoke.

typosquatting-campaign · eye-security · typesafe-ai (../llm-providers-wiki)