jup[.]ag-rewards[.]lat

This domain, jup.ag-rewards.lat, is flagged as a crypto scam impersonating the Jupiter brand, targeting users with fraudulent onchain finance offers. Registered on March 11, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to IP 104.21.75.119, hosted on Cloudflare's infrastructure (AS13335) in the US. Nameservers amos.ns.cloudflare.com and maya.ns.cloudflare.com further confirm Cloudflare's role in its hosting. The SSL certificate, issued by Let's Encrypt (serial E8), does not mitigate the domain's malicious intent, as it remains a standard security measure for phishing sites. Analysis indicates the domain was detected by one security blocklist (PhishDestroy) and flagged by 2 of 94 security vendors on VirusTotal, confirming its classification as a threat.

The page title, 'Jupiter | The Home of Onchain Finance,' directly mimics the legitimate Jupiter platform, reinforcing its brand impersonation tactics. No evidence of additional scam subtypes (e.g., drainer, giveaway) or specific attack vectors is present in the available data. Infrastructure review reveals the domain was taken offline by July 23, 2026, reducing immediate risk to users. However, defenders should treat any residual DNS or cached references as high-risk indicators.

The domain's registration details, Cloudflare hosting, and Let's Encrypt SSL are consistent with common phishing infrastructure but do not provide unique attribution. No further HTTP status, Safe Browsing results, or open-source intelligence (e.g., OTX) are available for cross-verification. Defenders are advised to block the domain and its resolving IP (104.21.75.119) at perimeter controls, monitor for related subdomains or typosquatting variants, and alert users to the Jupiter impersonation scam. The domain's offline status does not preclude future reactivation; continuous monitoring is recommended.