jup-airdrop[.]onspace[.]build

The domain jup-airdrop.onspace.build was registered on January 07, 2026 through Aceville Pte. Ltd. and resolves to the IP address 43.130.171.225, which is geolocated to the United States and associated with AS132203 (Tencent Building, Kejizhongyi Avenue). The site serves HTTP 200 responses and presents a page titled "Jupiter x OnSpace New Year Airdrop 2026 🎄". Technical fingerprints show the use of Tailwind CSS and the presence of HSTS, while the TLS certificate is issued by DigiCert Inc under the RapidSSL TLS RSA CA G1 hierarchy. The domain is listed on four security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, SEAL, and ScamSniffer. Google Safe Browsing flags it for "SOCIAL_ENGINEERING" and VirusTotal reports 16 detections out of 91 scanned vendors. Gridinsoft assigns a trust score of 0 out of 100. The threat profile is identified as a brand‑impersonation campaign targeting Jupiter, employing an "Airdrop Scam" kit that promises a fake airdrop. The current risk level is high and the domain remains active. While the exact page content has not been examined, the convergence of brand impersonation, a malicious airdrop narrative, and multiple vendor detections indicates a credible phishing operation. Defenders should block the domain at perimeter and endpoint layers, monitor DNS queries for the associated nameservers (anastasia.dnspod.net, anemone.dnspod.net), and add the IP to threat intel feeds. Ongoing surveillance of related infrastructure and rapid updating of detection signatures are recommended to mitigate potential user exposure.