claim[.]jupiter[.]ph

The domain claim.jupiter.ph is a phishing site engaged in brand impersonation targeting users of Jupiter, a cryptocurrency platform. It presents itself as an airdrop campaign under the title 'Jupiter | Airdrop' to deceive victims into connecting wallets, classified specifically as a wallet_connect_phish scam. No drainer kit was identified, but the site poses an elevated risk by attempting to harvest wallet credentials. As of the latest verification, claim.jupiter.ph has been taken offline.

Technical indicators confirm the malicious nature of claim.jupiter.ph. The domain was flagged by 2 of 95 security vendors on VirusTotal, including G-Data and Gridinsoft, which assigned it a trust score of 0/100. It appears on 2 security blocklists, PhishDestroy and ScamSniffer, though Google Safe Browsing did not flag it. The domain is registered through Cloudflare, Inc., with no creation date available, and resolves to the IPv6 address 2606:4700:3035::ac43:89bb, hosted on Cloudflare's network (AS13335) in the US. The SSL certificate is issued by Google Trust Services / WE1, and the site uses Cloudflare and HTTP/3 technologies. Nameservers were not found during analysis.

Users who interacted with claim.jupiter.ph should immediately revoke any token approvals granted to the site via wallet management tools like Revoke.cash or Etherscan's token approval checker. Move funds to a new wallet if credentials were exposed. Enable two-factor authentication on all accounts and monitor for unauthorized transactions. Report the domain to platforms such as PhishTank, Google Safe Browsing, or the impersonated brand's official security team to aid in takedown efforts.