claim[.]juplter[.]tw

Analysis of claim.juplter.tw shows a high‑risk brand‑impersonation campaign targeting the Jupiter brand. The domain was registered on 27 September 2025 through the registrar epag.de and is hosted on Cloudflare’s network (AS13335) with the IPv4 address 172.67.208.141 located in the United States. No TLS certificate is presented, indicating the site was served over HTTP only. The page title returned from the live host before takedown was "Jupiter | Airdrop", matching the declared phishing kit "Airdrop Scam" and the reported scam type "Wallet/Seed Phishing".

Gridinsoft assigns a trust score of 0 / 100, and Google Safe Browsing lists the domain for social‑engineering content. VirusTotal recorded 11 detections out of 95 scanners, and the domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer. Authoritative nameservers danica.ns.cloudflare.com and drake.ns.cloudflare.com confirm Cloudflare DNS configuration. The evidence confirms that claim.juplter.tw was actively used to harvest cryptocurrency wallet seeds by masquerading as a legitimate Jupiter airdrop page.

The site is currently offline, but the infrastructure—Cloudflare IP, registrar, and DNS records—remains observable. Defenders should block the IP address 172.67.208.141 and the domain itself at DNS and proxy layers, add the domain to internal phishing and malware blocklists, and monitor for future registrations that reuse the same registrar or similar sub‑domains. Continued watch on Cloudflare‑hosted assets and on the epag.de registrar may reveal related campaigns. At present, no further content is reachable, so additional behavioral analysis is not possible.