jupiter-airdrop-round-2[.]pages[.]dev

The domain jupiter-airdrop-round-2.pages.dev has been identified as a brand impersonation threat specifically targeting Discord users. It poses as a legitimate Jupiter airdrop page, promising "Get 700M JUP: Jupiter Airdrop Round 2 Guide 2025," but in reality it is a phishing site designed to steal credentials and potentially cryptocurrency assets. No drainer kit was detected, but the social engineering lure is strong enough to trick unsuspecting users.

Technical analysis reveals that this domain was flagged by 2 out of 95 security vendors on VirusTotal, indicating moderate detection. It was registered through Cloudflare, Inc. on February 11, 2025, and resolves to IP address 188.114.96.3. The SSL certificate is issued by Google Trust Services (WE1), adding a false sense of security. The domain appears on one security blocklist but was not listed on Google Safe Browsing at the time of analysis. These indicators collectively confirm the domain's malicious intent.

As of the latest check, the domain is offline, likely as a result of takedown efforts. However, similar threat actors may reuse the IP or registrar, so users should remain vigilant. PhishDestroy recommends that anyone who interacted with this domain change their Discord password immediately and enable two-factor authentication. Avoid clicking links in unsolicited airdrop offers, and always verify official channels. The remaining risk is low due to the takedown, but copycat domains may appear.