claim[.]juplter[.]city

On July 23, 2026 the domain claim.juplter.city was identified as a high‑risk brand‑impersonation site targeting the cryptocurrency brand Jupiter. The site resolves to the IP address 104.21.40.38, which is hosted in the United States under AS13335 Cloudflare, Inc. Cloudflare also appears as the registrar, indicating that the attacker leveraged the provider’s DNS and proxy services to conceal the true origin of the infrastructure. No SSL certificate is presented, confirming that the site is served over plain HTTP and lacks transport‑layer encryption. The domain is currently offline, but historical snapshots show that the page title was “Jupiter | Airdrop”, matching the known “Airdrop Scam” phishing kit used by actors to lure victims into submitting wallet credentials or seed phrases.

Multiple detection sources have flagged the domain. VirusTotal recorded 13 positive detections out of 95 scanned vendors, and the domain appears on two independent blocklists. Google Safe Browsing categorized the site under social‑engineering threats, while PhishDestroy and ScamSniffer have actively blocked access. Additional reputation services, such as Gridinsoft, assigned a trust score of zero out of one hundred, reflecting extreme malicious confidence.

The lack of a resolvable nameserver (NS_NOT_FOUND) suggests that the authoritative DNS records may have been removed or intentionally hidden after the site was taken down. This complicates attribution but does not diminish the observed malicious behavior. The combination of a high‑risk phishing kit, confirmed brand impersonation, and the use of a reputable CDN provider for anonymity indicates a deliberate campaign aimed at harvesting private keys or seed phrases from unsuspecting Jupiter users.

Defenders should continue to monitor the 104.21.40.38 address for any re‑activation, enforce domain‑based blocklists that include claim.juplter.