jupags[.]pages[.]dev

Analysis of jupags.pages.dev indicates that the domain was created on 21 February 2026 and is hosted on Cloudflare’s infrastructure, resolving to IP 188.114.96.3 which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The site presents the page title “Jupiter | Airdrop”, directly referencing the Jupiter brand, and the intelligence tags identify the operation as a “Fake Airdrop” impersonating Jupiter. No TLS certificate is present, meaning the site serves content only over HTTP, which further reduces trust. The domain appears on one public security blocklist and is actively blocked by the PhishDestroy service.

Malware scanning on VirusTotal shows that four of ninety‑five security vendors flagged the host, confirming that at least a subset of scanners consider the content malicious. The observed phishing kit is labeled “Airdrop Scam”, matching the advertised airdrop lure. Registration details list Cloudflare, Inc. as the registrar, a common choice for disposable or rapidly‑rehosted malicious infrastructure. Current monitoring shows the domain has been taken offline, but the historical footprint remains relevant for correlation with other campaigns that reuse the same IP range or kit.

Because the site is currently offline, direct inspection of the page content is not possible, and the exact appearance of the airdrop lure cannot be verified. Defenders should continue to block the domain and its associated IP address, monitor for any re‑registration of the same host name or similar subdomains under the pages.dev namespace, and apply brand‑specific detection rules for Jupiter‑related airdrop terminology. Standard web‑gateway or DNS‑filtering solutions will likely already prevent access, but additional threat‑intel feeds that reference the “Airdrop Scam” kit can improve early detection of related infrastructure.