Scammers are exploiting the recent launch of Jev, an AI model that returns decisions rather than conventional text responses, by setting up bogus storefronts that appear legitimate.
Despite the official Jev model debut on September 15, 2026, lookalike domains emerged just three days later under different registrars. These fake sites mimic official storefronts—offering documentation, playgrounds, pricing, and checkout interfaces—but funnel user inputs through third-party servers before reaching Jev’s real API. That means anyone who believes they are using the genuine service may unknowingly expose prompts and content to unknown operators.
Eye Security researchers uncovered multiple such sites that outranked Jev’s own site in search results. Users paying through these impostors can be charged up to 11.5 times the official rate. While Jev’s true cost is about $0.042 per million input tokens, the fraudulent sites listed monthly plans translating to $0.247–$0.483 per million tokens. Even with annual pricing, savings still required upfront payment.
Shared Schemes and Brand Impersonation
The bogus storefronts all use shared templates, repurposing design and code across sites promoting AI tools for music, video, and graphics. Operators shifted branding depending on which model gained popularity, flying under the radar by tweaking logos and names. One example showed billing text for a video model still present, despite being branded for Jev. Common sales tactics appeared too—welcome credits, “daily rewards,” and countdown timers to push users into purchase decisions.
Certificate records showed that in the eight days after Jev’s launch, some 670 domains containing its name were registered—about double the typical background rate. Not all are necessarily dangerous, but many are linked to those clone storefronts. Researchers flagged domains that actively pass requests (and potential content) through third parties without making clear that they’re re-selling access.
Privacy and Security Risks
It remains unclear whether these operators are storing or abusing any data. The researchers found at least one site that routed all activity through an app hosted on Railway and protected by Cloudflare, then forwarded it to the official API. No service agreement was found describing how logs or prompt data are handled. Customers have no guarantee who has visibility into their private business inputs.
Misleading practices include ambiguous legal disclaimers buried in footers, no disclosure upfront at checkout, and inflated prices. All this combined to raise flags about both cost and confidentiality.
Domains identified as confirmed or suspected resellers include jev-ai[.]pro, jevtypesafeai[.]com, jev-agent[.]org, among others. Less certain registrations include domains listed for sale or blank pages; all branded with Jev-related strings. Test your source: look up the official announcement or developer’s site for valid access links.
Security best practices: compare the per-token rates advertised; check the domain’s registration date and SSL certificates; read terms to confirm who handles data; and when in production environments, make sure your usage is direct or via a trustworthy gateway.
Analysis: Brand impersonation in AI isn’t new, but the speed and scale here underscore serious vulnerabilities in user trust and discovery. In Jev’s case, clone merch appeared nearly immediately, and search-ranking manipulation let impostors get ahead. Beyond overcharging, the risk is business or personal secrets inadvertently exposed via unknown servers. Watch how Jev and similar platforms respond—whether by legal action, improved discovery tools, or verifying officially listed domains. For users, enforcing due diligence may become standard hygiene in AI tool adoption.
