claim[.]juplter[.]at

The domain claim.juplter.at was observed hosting a malicious page that presents itself as a Jupiter airdrop portal. The page title returned by HTTP requests is “Jupiter | Airdrop”, which aligns with the advertised “Airdrop Scam” phishing kit identified by analysts. The site impersonates the cryptocurrency brand Jupiter and attempts to harvest wallet seeds, fitting the classification of wallet/seed phishing. VirusTotal analysis shows that 11 out of 95 security scanners flagged the domain, indicating a moderate level of detection across mainstream tools. Google Safe Browsing also marks the host as a social engineering threat.

Independent blocklists maintained by PhishDestroy and ScamSniffer have added the domain, and it appears on two additional security blocklists, reinforcing its malicious reputation. The domain resolves to 172.67.171.18, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The hosting provider’s generic nameservers—erin.ns.cloudflare.com and hank.ns.cloudflare.com—are typical of Cloudflare‑protected services, which can obscure the actual origin of the payload. No SSL certificate is presented, causing HTTP connections to be unencrypted and making the site more susceptible to interception. Registration data indicates the domain was registered through Key‑Systems GmbH, the Austrian registrar listed at nic.at, although the registrar’s public page returns a 404 response, limiting immediate verification of registration details.

Scamadviser assigns a trust score of 1 out of 100, reflecting an extremely low reputation. As of the report date, the site is reported offline, but the infrastructure components—IP address, hosting provider, and nameserver configuration—remain active and could be reused for future campaigns. Defenders should continue to block the domain at perimeter filters, monitor the associated IP range for reappearance of phishing content, and consider adding the host to internal URL reputation lists.