jup-airdrop[.]onspace[.]app

The domain jup-airdrop.onspace.app is flagged as a high‑risk brand‑impersonation site targeting the Jupiter brand. Infrastructure analysis shows the domain was registered on February 21, 2026 through NameCheap, Inc., and resolves to IP 43.130.171.152, which is geolocated to the United States and belongs to AS132203 (Tencent Building, Kejizhongyi Avenue). The authoritative nameservers are anastasia.dnspod.net and anemone.dnspod.net. TLS is provided by a Sectigo RSA Domain Validation certificate, and the site enforces HSTS. Detected front‑end technologies include Tailwind CSS. The page title "Jupiter x OnSpace New Year Airdrop 2026 🎄" indicates a crypto airdrop lure, and the known phishing kit is identified as an Airdrop Scam. VirusTotal reports 18 of 93 security vendors flag the domain, and Google Safe Browsing classifies it under SOCIAL_ENGINEERING. The domain appears on four security blocklists and is actively blocked by PhishDestroy, MetaMask, SEAL, and ScamSniffer. Given the combination of brand impersonation, a crypto‑scam narrative, and multiple security vendor detections, defenders should block the domain at network and endpoint layers, monitor for any related command‑and‑control traffic from the associated IP, and educate users about the fraudulent airdrop lure. Ongoing threat‑intel feeds should be consulted for any updates to the kit or additional indicators of compromise.