jupiter-airdropp[.]pages[.]dev

Analysis indicates that the domain jupiter-airdropp.pages.dev is actively impersonating Jupiter, a known cryptocurrency platform, as part of an airdrop-themed phishing operation. The domain was registered on June 13, 2026, and is hosted on Cloudflare infrastructure, resolving to the IP address 172.66.44.83. It is flagged by seven security vendors on VirusTotal and holds a trust score of 0/100 from Gridinsoft, reflecting high-risk classification. The domain appears on two security blocklists, including ScamSniffer and PhishDestroy, which specifically identify it as part of an airdrop scam campaign. The page title, 'JUP Network Retrospective Airdrop,' directly references Jupiter, reinforcing the brand impersonation threat. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3 and HSTS, alongside third-party resources such as SweetAlert2, jsDelivr, and cdnjs. The SSL certificate is issued by Google Trust Services, which is consistent with legitimate domains but does not mitigate the fraudulent intent. The domain remains active as of July 12, 2026, and defenders should treat it as a confirmed phishing endpoint. Organizations should block this domain at the network level and monitor for related indicators, such as the IP address and associated phishing kit artifacts. The exact content and functionality of the site have not been analyzed, but the combination of brand impersonation, airdrop-themed lures, and security vendor detections provides sufficient evidence to classify this as a high-risk threat.