uikolasm[.]top

This domain is flagged for elevated risk due to targeted brand impersonation, specifically designed to deceive users with a fraudulent Jupiter airdrop scheme. The threat type involves social engineering tactics to harvest credentials or distribute malicious payloads under the guise of a legitimate cryptocurrency distribution event. Analysis indicates the domain was crafted to exploit trust in the Jupiter brand, likely targeting users seeking participation in token airdrops or promotional events. Infrastructure analysis reveals the domain uikolasm.top was registered on November 12, 2025, through NameSilo, LLC, and resolves to the IP address 57.129.97.29. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The page title, 'Jupiter | Airdrop,' directly mimics official Jupiter communications, increasing the likelihood of successful deception. The domain has since been taken offline, but historical data confirms its use in active phishing campaigns. Mitigation steps for this threat type include blocking the domain and its associated IP (57.129.97.29) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to newly registered domains impersonating known brands, particularly those related to cryptocurrency. Users should be educated to verify airdrop legitimacy through official channels only, avoiding unsolicited links or promotions. Monitoring for similar domains registered via NameSilo or resolving to the same IP range may help identify related threats.