jupairdrops[.]pages[.]dev

This domain, jupairdrops.pages.dev, is identified as an active brand impersonation threat targeting Jupiter, a decentralized finance platform. The site presents itself as an official airdrop campaign titled "Jupuary 2025 | Jupiter," designed to deceive users into disclosing sensitive credentials or transferring assets under false pretenses. Analysis confirms this as a high-risk phishing operation, currently unresolved and accessible to potential victims. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on January 26, 2025, and resolves to the IP address 172.66.45.32, hosted within Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s services. Security vendor assessments indicate that 6 of 95 engines on VirusTotal flag the domain as malicious. Additionally, the domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The page title, "Jupuary 2025 | Jupiter," directly mimics Jupiter’s branding, reinforcing the impersonation attempt. Current status confirms the domain remains active, posing an ongoing risk to users unaware of the fraudulent nature of the site. Organizations and individuals are advised to implement immediate blocking of jupairdrops.pages.dev at the DNS or network level. End-users should be educated to recognize phishing indicators, such as unsolicited airdrop claims, and verify official communications through Jupiter’s authenticated channels. Security teams are recommended to monitor for related infrastructure, including subdomains or IPs associated with 172.66.45.32, and assess logs for connections to this domain to identify potential compromise.