jupiterdrop[.]xyz

Analysis of jupiterdrop.xyz indicates that the domain was registered on 2026-03-03 through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers kay.ns.cloudflare.com and trey.ns.cloudflare.com resolve the zone to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP. The HTTP response includes the title “Jupiter | Airdrop”, consistent with the declared scam kit “Airdrop Scam” and the classification as a crypto‑related scam impersonating the brand Jupiter. The domain is currently listed as offline, and the same infrastructure has been flagged by multiple industry blocklists, including PhishDestroy, MetaMask, ScamSniffer and SEAL.

In addition, the domain appears on four external security blocklists and has been reported to VirusTotal, where 16 of 93 scanning engines returned a malicious verdict. The observed indicators suggest a purposeful attempt to lure cryptocurrency users by promising an airdrop tied to the Jupiter brand. The use of Cloudflare’s network provides resilience and anonymity, while the lack of TLS further lowers the credibility of the site. Because the site is already taken offline, active exploitation may be limited, but the registration pattern and blocklist presence indicate a reusable template that could be redeployed under new domains.

Uncertainty remains regarding the exact payload delivered to victims, as no page content beyond the title has been captured, and the absence of a certificate prevents HTTPS‑based inspection. Defenders should continue to block the IP address 188.114.96.3 and the domain jupiterdrop.xyz at network perimeter and DNS layers. Adding the domain to internal phishing and malware blocklists, as well as monitoring for future registrations that reuse the same nameserver set or AS13335 hosting, is recommended.