jup[.]ag-claimcode[.]sbs

Analysis as of July 23, 2026 shows that the domain jup.ag-claimcode.sbs was registered on February 21, 2026 and is presently taken offline. The site presented the page title "X. It’s what’s happening / X," which does not reference the targeted brand but the intelligence flags the domain as impersonating Apple and classifies the activity as a tech support scam. The domain resolves to the IP address 172.66.0.227, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States.

The SSL certificate associated with the host is identified as WE1, a certificate that typically lacks extended validation and offers minimal assurance of legitimacy. Reputation data from Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal reports that 14 of 93 scanning engines flagged the domain, reinforcing the suspicion of abuse. The domain is listed on at least one security blocklist and has been actively blocked by the PhishDestroy mitigation service.

No additional content or page‑level artifacts have been captured, so the exact phishing landing page layout, credential capture mechanisms, or malicious payload delivery remain unverified. Defenders should continue to blacklist jup.ag-claimcode.sbs at DNS and proxy layers, monitor for any re‑registration or resurrection of the domain, and apply URL filtering based on the observed IP range and Cloudflare ASN. Given the low trust score, vendor detections, and confirmed impersonation of Apple, the domain should be treated as a confirmed malicious infrastructure pending further observation.