bonkliveo22[.]pages[.]dev

This domain, bonkliveo22.pages.dev, operates as a high-risk phishing endpoint targeting users of the Jupiter platform. The site presents a fraudulent airdrop page, leveraging the brand's reputation to deceive visitors into disclosing sensitive credentials or transferring cryptocurrency assets. The page title, 'Airdrop | Jupiter,' directly mimics legitimate promotional campaigns, increasing the likelihood of successful social engineering attacks against unsuspecting users seeking token distributions or rewards. Analysis indicates the domain was registered on January 05, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.90, associated with Cloudflare's US-based infrastructure (AS13335). Security vendor detections on VirusTotal report 14 out of 95 engines flagging the domain as malicious. The site appears on two security blocklists, including PhishDestroy and ScamSniffer, and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security while facilitating encrypted communication for malicious purposes. Users who visited bonkliveo22.pages.dev should immediately revoke any permissions granted to connected wallets or applications. If credentials or private keys were entered, affected parties must transfer assets to a new, secure wallet and monitor accounts for unauthorized transactions. Browser data, including cookies and cached files, should be cleared to eliminate residual tracking mechanisms. Network-level blocking of the domain and its resolving IP (172.66.44.90) is recommended to prevent further exposure. Organizations should update internal blocklists with this indicator of compromise to mitigate risk across enterprise environments.