claim[.]jupiter[.]how

The domain claim.jupiter.how was observed targeting the Jupiter brand through a crypto‑scam impersonation campaign. Infrastructure analysis shows the domain resolves to the IP address 172.67.137.9, which belongs to Cloudflare, Inc. (AS13335) and is hosted in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint despite the malicious intent. An HTTP request to the host returns a 403 status code, suggesting the site is presently inaccessible; the current status is listed as offline. VirusTotal records indicate that 13 of 95 scanned security vendors flagged the domain, corroborating its malicious classification.

Google Safe Browsing has marked the URL for social engineering, and the domain appears on two independent blocklists, PhishDestroy and ScamSniffer, reinforcing the threat assessment. The registrar information shows registration through Cloudflare, Inc., while the nameserver field returned NS_NOT_FOUND, implying that standard DNS delegation data were not retrieved. Detected technologies are limited to Cloudflare, consistent with the hosting provider. Uncertainty remains regarding the exact content of the landing page, as no page title or additional payload details were captured before the takedown.

Consequently, analysts cannot confirm the specific phrasing or visual elements used in the impersonation, only that the campaign is labeled as a crypto scam. Defenders should proactively block claim.jupiter.how at the network perimeter and add it to internal URL filtering lists. Email security gateways should be updated to flag any messages containing this domain, especially those referencing cryptocurrency transactions or requests for Jupiter‑related credentials.