app[.]lavanda[.]icu

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users into engaging with fraudulent Jupiter airdrop schemes. Analysis indicates the infrastructure is specifically crafted to mimic legitimate cryptocurrency distribution events, likely functioning as a crypto drainer to siphon digital assets from victims' wallets. Infrastructure analysis reveals the following technical indicators: the domain app.lavanda.icu was registered on October 11, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to IP address 104.21.81.186. Security vendors on VirusTotal detect the domain as malicious, with 5 out of 95 flagging it. The domain appears on at least one security blocklist (PhishDestroy) and holds a Gridinsoft trust score of 0/100. The page title, 'Jupiter | Airdrop,' directly impersonates the Jupiter cryptocurrency platform, reinforcing its fraudulent intent. Users should treat this domain as a confirmed crypto drainer threat. Immediate mitigation steps include blocking the domain and associated IP (104.21.81.186) at the network level, revoking any wallet permissions granted during interaction, and reporting the domain to relevant cryptocurrency security platforms. Individuals who engaged with the site should audit their wallets for unauthorized transactions and consider migrating assets to a new wallet if compromise is suspected. Cryptocurrency platforms and security teams should update detection rules to include this domain and its infrastructure in threat intelligence feeds.