ag-usa[.]info

The domain ag-usa.info was observed serving a brand‑impersonation page titled "Jupiter | Airdrop" and is classified as a crypto‑scam using the publicly‑identified Airdrop Scam kit. Infrastructure analysis shows the domain is registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The authoritative name servers are kayden.ns.cloudflare.com and mimi.ns.cloudflare.com, both owned by Cloudflare. No TLS certificate is presented, indicating the site was served over plain HTTP.

The domain has been placed on a single security blocklist and is reported as blocked by PhishDestroy. VirusTotal records indicate the domain was scanned by 95 anti‑malware vendors, none of which raised a detection at the time of analysis; this absence of detections does not constitute evidence of safety. The current operational status is offline, and the site is no longer reachable. While the available evidence confirms the use of a known cryptocurrency airdrop phishing kit and the impersonation of the Jupiter brand, no additional artifacts such as malware payloads, credential‑harvesting forms, or redirect chains have been captured.

Consequently, the precise scope of victim exposure remains uncertain. Defenders should continue to monitor the associated IP address and Cloudflare name servers for any re‑use, enforce domain‑level blocking for ag-usa.info in web filters, and consider adding the domain to internal threat‑intel feeds. Given the lack of SSL and the offline status, any future re‑appearance would likely be detectable through DNS and blocklist monitoring. Organizations that handle Jupiter‑related communications should educate users about unsolicited airdrop offers and verify URLs against official sources.