claim[.]juplter[.]la

Analysis as of July 23 2026 indicates that the domain claim.juplter.la is actively listed as a malicious infrastructure element. The site was registered on 30 September 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) with the IP address 188.114.97.3 located in the United States. DNS resolution uses the Cloudflare name servers osmar.ns.cloudflare.com and surina.ns.cloudflare.com. No TLS certificate is presented, leaving the HTTP connection unencrypted.

The page title returned from the now‑offline site reads “Jupiter | Airdrop”, matching the “Airdrop Scam” phishing kit and the declared scam type of wallet/seed phishing. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports a single positive detection out of 95 scanners. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, confirming its inclusion in known threat‑intelligence feeds. Evidence confirms that the operator is attempting to harvest cryptocurrency wallets or seed phrases by masquerading as a Jupiter‑related airdrop, but the actual content of the landing page has not been captured, leaving the specific credential‑capture mechanisms unverified.

The lack of SSL, combined with the use of a reputable CDN, suggests an attempt to balance anonymity with rapid deployment. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and add the domain to internal threat‑intel watchlists. Continuous re‑scanning with URL‑analysis tools is advised to capture any future changes should the site be re‑activated.