claim[.]jup-s3[.]top

Analysis of claim.jup-s3.top shows a newly registered domain (creation date February 21 2026) that is actively used for a brand‑impersonation campaign targeting the Jupiter brand. The site resolves to IP 188.114.97.3, which is hosted in the United States under ASN 13335 owned by Cloudflare, Inc. The domain is served through Cloudflare’s infrastructure, with HTTP/3 enabled and an SSL certificate issued by Google Trust Services (WE1). DNS is managed by Cloudflare name servers mona.ns.cloudflare.com and rob.ns.cloudflare.com. HTTP requests return a 403 status, indicating that direct access is denied, yet the domain remains listed as active in security feeds. The page title presented to visitors is “Un instant…”, providing no further context about the malicious payload.

The domain appears on one external blocklist and is actively blocked by PhishDestroy. VirusTotal analysis records six of ninety‑three scanning engines flagging the host, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of zero out of one hundred, reflecting an extremely low reputation. Registration is handled by PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar commonly associated with disposable or low‑cost domains.

The campaign is classified as a crypto‑scam, leveraging the Jupiter brand to deceive victims into financial loss. While the exact content of the site has not been publicly captured, the combination of brand impersonation, low trust scores, multiple vendor detections, and blocklist presence provides strong evidence of abuse. Defenders should immediately block claim.jup-s3.top at perimeter firewalls and DNS filters, monitor outbound connections for attempts to resolve the IP address, and update threat intelligence feeds with the observed indicators. Continuous re‑scanning is advised to detect any changes in the site’s behavior, and any observed traffic should be logged for forensic correlation with potential victim reports.