claims-dashboard[.]live

This domain, claims-dashboard.live, is actively impersonating Google as part of a high-risk phishing infrastructure. Registered on May 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 188.114.97.3, which is associated with Cloudflare, Inc. in Canada. Analysis indicates the domain is configured with Cloudflare nameservers (arturo.ns.cloudflare.com and harmony.ns.cloudflare.com) and uses a Let's Encrypt SSL certificate, a common tactic to lend legitimacy to malicious sites. Despite returning an HTTP 403 status, the domain remains operational and is flagged by multiple security sources. Infrastructure analysis reveals that claims-dashboard.live appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. It has also been identified in one AlienVault OTX threat intelligence pulse, further corroborating its malicious classification. With a Gridinsoft trust score of 0/100 and detection by 9 out of 95 security vendors on VirusTotal, the domain exhibits strong indicators of phishing activity targeting Google users. The use of Cloudflare infrastructure is notable, as it may obscure the true origin of the threat and complicate takedown efforts. What remains uncertain is the exact phishing kit or payload deployed, as the HTTP 403 status suggests the site may be in a preparatory or restricted-access phase. Defenders should treat this domain as an active threat and prioritize blocking it at the DNS or network level. Monitoring for related domains registered through the same registrar or resolving to the same IP may uncover additional components of this campaign. Given the domain's recent creation and persistent blocklist presence, organizations should assume it will be used in ongoing phishing operations unless mitigated.