jup[.]ag-claim[.]pro

The domain jup.ag-claim.pro has been identified as a high‑risk brand‑impersonation site targeting the Jupiter brand. It is currently active and serves a counterfeit Jupiter landing page, as indicated by its classification as a brand‑impersonation threat. Detection services have recorded the domain since its registration on April 20 2026, and it is listed as a high‑severity indicator in several threat feeds.

Infrastructure analysis shows the domain is hosted behind Cloudflare’s network, resolving to IP address 104.21.11.8, which is geolocated to Canada and owned by Cloudflare, Inc. The authoritative nameservers are santino.ns.cloudflare.com and ophelia.ns.cloudflare.com, both belonging to Cloudflare. The site presents a valid TLS certificate from Let’s Encrypt (certificate identifier E8), but HTTP requests return a 403 status code, suggesting intentional denial of content to casual browsers while still allowing scripted access.

Threat intelligence corroborates the malicious intent: PhishDestroy has blocked the domain, Google Safe Browsing flags it for SOCIAL_ENGINEERING, and VirusTotal reports that 16 of 95 scanned security vendors flagged the host as malicious. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external blocklist. These independent signals reinforce the assessment of a coordinated impersonation campaign.

Defenders should immediately add jup.ag-claim.pro to deny‑list rules across DNS, proxy, and endpoint protections. Continuous monitoring of the associated IP address and Cloudflare nameservers is advised, as adversaries may reuse the same infrastructure for additional domains. Analysts should also review any recent Jupiter‑related traffic for signs of credential harvesting or redirection attempts, and enforce user education regarding unsolicited Jupiter communications.