jupusd[.]onspace[.]build

Analysis of jupusd.onspace.build shows an active domain registered on January 07 2026 through Aceville Pte. Ltd. and configured with a DigiCert Inc SSL certificate. The domain resolves to IP address 43.130.171.152 and hosts a page titled OnSpace × JUP.ag | 25,000,000 JupUSD Airdrop. Infrastructure evidence ties the site to brand impersonation of Google combined with an airdrop scam kit. Multiple security vendors have already recorded the domain on four distinct blocklists while Google Safe Browsing lists it under SOCIAL_ENGINEERING.

VirusTotal detection stands at 14 out of 95 engines. Gridinsoft assigns a trust score of 0 out of 100. The domain remains reachable and has not been taken down since its registration six months earlier. No registrant contact details or ownership chain beyond the registrar name appear in the available records, leaving precise attribution uncertain. The combination of the observed page title, listed phishing kit, and explicit Google impersonation label confirms the threat classification beyond generic suspicion.

Defenders should add the exact domain and its current A record 43.130.171.152 to internal blocklists and sinkhole configurations. Continuous monitoring of the IP for additional hostnames and periodic rechecks of the SSL certificate serial are recommended to detect any migration. Organizations protecting users from credential harvesting or wallet-draining campaigns should treat all traffic to this domain as malicious until the site is confirmed offline or seized.