jup-nft[.]pages[.]dev

Analysis of the domain jup-nft.pages.dev, observed on July 22, 2026, indicates that it was used to host a counterfeit airdrop page impersonating the Jupiter brand. The domain resolves to IP address 188.114.97.3, which is hosted by Cloudflare, Inc. (AS13335) and located in the United States. Registration data shows the domain was created on February 21, 2026 and was registered through Cloudflare, Inc., a common registrar for disposable or fast‑deployment sites. No SSL certificate is present, leaving the site without encrypted transport.

The page title returned by the server is "Jupiter | Airdrop," matching the declared scam type of a "Fake Airdrop" and confirming the brand‑impersonation intent. The underlying phishing kit has been identified as the "Airdrop Scam" kit, a known template used to lure victims with promised token distributions. The site has been blocked by the PhishDestroy blocklist and appears on one additional security blocklist, indicating that at least one external threat‑intel source has taken action against it. VirusTotal records show that the domain was scanned by 93 security vendors, none of which reported a detection; however, the absence of detections does not constitute a safety assurance.

The current status is offline, suggesting the operator has removed the content or the hosting has been terminated, but the infrastructure footprint remains observable. Defenders should continue to block the domain at network perimeters, monitor for new domains resolved to the same IP range or sharing the same registration patterns, and advise users to disregard any unsolicited Jupiter‑branded airdrop communications. Ongoing surveillance is recommended to detect any re‑deployment of the kit or similar brand‑impersonation campaigns.