# PhishDestroy domain threat record: claimcredits.online Content language: English Canonical HTML report: https://phishdestroy.io/domain/claimcredits.online/ Machine-readable companion: https://phishdestroy.io/domain/claimcredits.online/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 14:29:18 UTC - Last availability or vendor check: 2026-10-25 23:00:41 UTC - Stored record updated: 2026-10-26 10:39:08 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: gmail ## Stored infrastructure - Observed IP address: 2.57.91.159 - Registrar in stored WHOIS data: HOSTINGER operations, UAB - Registrar country in stored WHOIS data: LT - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2025-08-22 08:20:28 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16e52-a3b8-75e8-a88b-eb4e0dc7b5b7/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/claimcredits.online - Certificate Transparency search: https://crt.sh/?q=%25.claimcredits.online - Web Archive lookup: https://web.archive.org/web/*/https://claimcredits.online/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added claimcredits.online to its internal blocklist because VirusTotal reported two malicious vendor detections. The recorded page title was "Home – Claim Credits". The domain was first seen by PhishDestroy on 2026-10-24 and returned an HTTP 200 response on that date. How the scam works No specific malicious behavior was observed on the page, but the presence of phishing detections indicates the site could be used to impersonate legitimate services and harvest credentials or personal data. General phishing tactics involve presenting trusted‑looking content to lure visitors into submitting sensitive information. Evidence VirusTotal scanned the domain on 2026-10-19 (retrieved 2026-10-24) and recorded three detections: two malicious (Gridinsoft, SOCRadar) and one suspicious (alphaMountain.ai). Google Safe Browsing checked on 2026-10-24 and did not flag the site. urlscan.io captured the page on 2026-10-24; its overall verdict was clean, though its engine scoring marked the URL as malicious with a 94 % confidence. OTX listed zero pulses as of 2026-10-24. No external blocklists reported the domain, and PhishDestroy’s internal list marked it based on the VirusTotal findings. Infrastructure The domain was registered on 2025-08-22 through HOSTINGER operations, UAB, giving it an age of 428 days. DNS records point to Hostinger parking nameservers and MX records at mx1.hostinger.com and mx2.hostinger.com. Recorded IP addresses include 2.57.91.159 (Hostinger CDN) and additional addresses observed by Cloudflare Radar. The site uses a Let's Encrypt TLS certificate valid from 2026-10-18 to 2027-01-16 and does not have DNSSEC enabled. What to do Treat claimcredits.online as suspicious and avoid entering any personal or financial information. If credentials were submitted, change the associated passwords immediately. Network defenders should block the exact domain and monitor for traffic to the recorded IPs, and consider adding the domain to internal threat feeds. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16e52-a3b8-75e8-a88b-eb4e0dc7b5b7/ Cloudflare Radar report: https://radar.cloudflare.com/scan/32e9ac96-7768-4b81-b9e0-3e30cbdc0d30 Stored capture screenshot: https://urlscan.io/screenshots/01a16e52-a3b8-75e8-a88b-eb4e0dc7b5b7.png Cloudflare Radar screenshot (2026-10-24T14:31:34Z): https://screenshots.phishdestroy.io/cf/32e9ac96-7768-4b81-b9e0-3e30cbdc0d30.png URLScan screenshot (2026-08-19T22:04:32Z): https://screenshots.phishdestroy.io/us/01a01c0d-d12f-74a8-a298-c06f32076cd2.png URLScan capture report: https://urlscan.io/result/01a01c0d-d12f-74a8-a298-c06f32076cd2/ URLScan screenshot (2026-08-20T03:28:58Z): https://screenshots.phishdestroy.io/us/01a01d36-d8b1-700d-898b-712591944824.png URLScan capture report: https://urlscan.io/result/01a01d36-d8b1-700d-898b-712591944824/ URLScan screenshot (2026-10-19T05:18:28Z): https://screenshots.phishdestroy.io/us/01a15298-af86-749e-b7b1-ec66d2ccf2f1.png URLScan capture report: https://urlscan.io/result/01a15298-af86-749e-b7b1-ec66d2ccf2f1/ URLScan screenshot (2026-10-19T05:44:10Z): https://screenshots.phishdestroy.io/us/01a152b0-1d02-7178-96f7-caa566e3dded.png URLScan capture report: https://urlscan.io/result/01a152b0-1d02-7178-96f7-caa566e3dded/ URLScan screenshot (2026-10-19T06:52:52Z): https://screenshots.phishdestroy.io/us/01a152ef-258e-734d-831f-0312ff0c208b.png URLScan capture report: https://urlscan.io/result/01a152ef-258e-734d-831f-0312ff0c208b/ URLScan screenshot (2026-10-19T08:42:36Z): https://screenshots.phishdestroy.io/us/01a15353-83ae-729d-a2b4-6efd0ed4b399.png URLScan capture report: https://urlscan.io/result/01a15353-83ae-729d-a2b4-6efd0ed4b399/ VirusTotal report: https://www.virustotal.com/gui/domain/claimcredits.online Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=claimcredits.online Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-24 14:34:48 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a16e52-a3b8-75e8-a88b-eb4e0dc7b5b7.png Captured: 2026-10-24 14:33:13 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16e52-a3b8-75e8-a88b-eb4e0dc7b5b7.png Captured: 2026-10-24 14:33:13 UTC Source report: https://urlscan.io/result/01a16e52-a3b8-75e8-a88b-eb4e0dc7b5b7/ - URLScan capture 2: https://urlscan.io/screenshots/01a15353-83ae-729d-a2b4-6efd0ed4b399.png Captured: 2026-10-24 14:29:18 UTC Source report: https://urlscan.io/result/01a16e52-a3b8-75e8-a88b-eb4e0dc7b5b7/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/32e9ac96-7768-4b81-b9e0-3e30cbdc0d30.png Captured: 2026-10-24 14:31:34 UTC Source report: https://radar.cloudflare.com/scan/32e9ac96-7768-4b81-b9e0-3e30cbdc0d30 SHA-256: 468dbf373f3fa838e21f968d5c08ae34c8f231015d6f1486f5a64989efc72441 - URLQuery: https://screenshots.phishdestroy.io/uq/475dd66c-26b5-4f2d-bad3-cf704731131f.png Source report: https://urlquery.net/report/475dd66c-26b5-4f2d-bad3-cf704731131f SHA-256: d6b99f4d61b41cefdb30248270a628062f911532dfa3eba6a89457cb41a4507b - URLScan · 2026-08-19: https://screenshots.phishdestroy.io/us/01a01c0d-d12f-74a8-a298-c06f32076cd2.png Captured: 2026-08-19 22:04:32 UTC Source report: https://urlscan.io/result/01a01c0d-d12f-74a8-a298-c06f32076cd2/ SHA-256: 0328f69e54401ff0c37380cfcd4889cc643255fad2c7ac87af7c32d6f0049d3e - URLScan · 2026-08-20: https://screenshots.phishdestroy.io/us/01a01d36-d8b1-700d-898b-712591944824.png Captured: 2026-08-20 03:28:58 UTC Source report: https://urlscan.io/result/01a01d36-d8b1-700d-898b-712591944824/ SHA-256: ab7a1a88dacca494e549a4d52b83004bfe501005651b9acefc79d78fc3e98a7e - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15298-af86-749e-b7b1-ec66d2ccf2f1.png Captured: 2026-10-19 05:18:28 UTC Source report: https://urlscan.io/result/01a15298-af86-749e-b7b1-ec66d2ccf2f1/ SHA-256: 10dc263ea70ae882b132df116e4b1c5f85f963790034a2973a7809a126eba68b - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a152b0-1d02-7178-96f7-caa566e3dded.png Captured: 2026-10-19 05:44:10 UTC Source report: https://urlscan.io/result/01a152b0-1d02-7178-96f7-caa566e3dded/ SHA-256: 4ee917c60e1e6a4e4da4eacbb18f87c4519ac2ed7b1cd38df7792104215559e8 - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a152ef-258e-734d-831f-0312ff0c208b.png Captured: 2026-10-19 06:52:52 UTC Source report: https://urlscan.io/result/01a152ef-258e-734d-831f-0312ff0c208b/ SHA-256: fee7d882411dc4d7632c02824ceffbcdb12ed0f00dbdf33f339372e14bf8e082 - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15353-83ae-729d-a2b4-6efd0ed4b399.png Captured: 2026-10-19 08:42:36 UTC Source report: https://urlscan.io/result/01a15353-83ae-729d-a2b4-6efd0ed4b399/ SHA-256: 03ca5bf2f4084689e3f651795fe4e7e657054d6e60a8b621b3c0a49dbc31c2cd ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T14:33:42Z", "uuid": "01a16e52-a3b8-75e8-a88b-eb4e0dc7b5b7", "scanned_at": "2026-10-24T14:31:18Z", "final_url": "https://claimcredits.online/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://claimcredits.online/", "from": "http://claimcredits.online/", "status": 307 } ], "ip": "2a02:4780:44:342c:9a75:554a:e3ea:6429", "domains": [ "c0.wp.com", "i0.wp.com", "fonts.gstatic.com", "startertemplatecloud.com", "cdn.tailwindcss.com", "www.google-analytics.com", "pixel.wp.com", "stats.wp.com", "fonts.googleapis.com", "www.googletagmanager.com", "www.transparenttextures.com" ], "ips": [ "2a00:1450:4001:c1f::66", "142.251.110.94", "172.67.73.212", "192.0.76.3", "92.113.16.0", "2606:4700:20::681a:28f", "192.0.77.2", "2a00:1450:4001:c0f::5f", "2a00:1450:4001:c25::61", "192.0.77.37", "2a02:4780:44:342c:9a75:554a:e3ea:6429" ], "asns": [ "15169", "13335", "2635", "47583" ], "countries": [ "DE", "US" ], "link_domains": [ "stage.startertemplatecloud.com" ], "doc_hash": "de6f480750b922b84402c1ac1a31473f4c3f47098d8145140d54f9e8259b75d2", "script_hashes": [ "29fdd17a7002a2e1bbd9b33adafc53457c64006b5aca8f6e4dbf907de35433ca", "ddcce687729cb358abf9d0d8e1217a097859be2b0d18c23d7c851b38c87bc9c0", "879d87ac73c901bf2074d98e8ccd154ce2ccea29c87e723b18b9c43f2359438d", "b0d0f70e74bc28354c15c9ff9164924c3191a67fd14f672088cc95a59bbe5a37", "070b8eea9db231e2f485862f42f2a0bb4e877edbf2bb5d9e080aea638473c995", "defafd5266c67a5ae6a3ce6f53845f744d56cc82a0bc1f9a8dc545ad2ac9dce7", "69d65d2de71c9765806fa0121f55cb69adeba53d8e33e9e164b10d825dfc26a3" ], "globals": [ "_wpemojiSettings", "gtag", "dataLayer", "_googlesitekit", "tailwind", "/template.html", "mc4wp", "wp", "sprintf", "vsprintf", "swv", "wpcf7", "kadenceConfig", "_stq", "b2a", "a2b", "ai_cookie_js", "ai_block_class_def", "ai_insertion_js", "Arrive", "ai_rotation_triggers", "ai_lists", "host_regexp", "m", "z", "B", "D", "X", "fa", "ha", "Q", "Y", "Z", "ea", "ma", "da", "ia", "b64e", "b64d", "ai_front" ], "cookies": [ "_ga_LL8V6F3YFC", "_ga" ], "storage_keys": [ "wpEmojiSettingsSupports" ], "tls": { "san": [ "claimcredits.online", "www.claimcredits.online" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "claimcredits.online", "protocol": "TLS 1.3", "valid_to": "2027-01-16T19:53:08Z", "valid_from": "2026-10-18T19:53:09Z" }, "domain_age_days": 428, "apex_age_days": 428, "tls_age_days": 5, "tls_valid_days": 89, "requests": 47, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 94, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "hcdn", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.2.34", "content-security-policy": "upgrade-insecure-requests" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T14:33:45Z", "uuid": "32e9ac96-7768-4b81-b9e0-3e30cbdc0d30", "scanned_at": "2026-10-24T14:31:34Z", "final_url": "https://claimcredits.online/", "status": 200, "history": [ { "url": "https://claimcredits.online/", "status": 200 } ], "dom_hash": "26da618f5e3494c903a9dc07e8f1048a4085ec09fe1aa084cd35229e26bf0ad1", "doc_hash": "de6f480750b922b84402c1ac1a31473f4c3f47098d8145140d54f9e8259b75d2", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "claimcredits.online", "type": "A", "value": "2.57.91.237" }, { "name": "claimcredits.online", "type": "A", "value": "88.222.222.101" }, { "name": "claimcredits.online", "type": "AAAA", "value": "2a02:4780:84:7cf7:ca25:1b0e:8337:eb30" }, { "name": "claimcredits.online", "type": "AAAA", "value": "2a02:4780:84:4fc2:f1a6:f08e:5f9f:fe7" } ], "dnssec_valid": false, "ip": "2.57.91.237", "whois": { "registrar": "HOSTINGER operations, UAB", "created": "2025-08-22T10:20:28Z", "updated": "2026-08-06T14:32:26Z", "expires": "2027-08-22T23:59:59Z", "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-24T14:31:05Z", "analysis_at": "2026-10-19T08:00:46Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 2, "suspicious": 1, "undetected": 35 }, "detections": { "SOCRadar": "phishing", "Gridinsoft": "phishing", "alphaMountain.ai": "suspicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Finance, Suspicious (alphaMountain.ai)" }, "registrar": "HOSTINGER operations, UAB", "created": "2025-08-22T10:20:28Z", "expires": "2027-08-22T23:59:59Z", "updated": "2026-08-06T14:32:26Z", "first_seen": "2025-08-22T10:58:44Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ns1.dns-parking.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.dns-parking.com" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 include:_spf.mail.hostinger.com ~all" }, { "ttl": 60, "type": "A", "value": "88.223.87.69" }, { "ttl": 14400, "type": "MX", "value": "mx1.hostinger.com", "priority": 5 }, { "ttl": 60, "type": "AAAA", "value": "2a02:4780:4b:dbae:7d15:4d6f:a630:fcf6" }, { "ttl": 14400, "type": "MX", "value": "mx2.hostinger.com", "priority": 10 }, { "ttl": 3600, "type": "SOA", "rname": "dns.hostinger.com", "value": "ns1.dns-parking.com" }, { "ttl": 60, "type": "A", "value": "145.223.124.180" }, { "ttl": 60, "type": "AAAA", "value": "2a02:4780:4d:e399:9902:5c61:bf9e:f868" } ], "dns_at": "2026-10-19T08:06:04Z", "jarm": "27d40d40d00040d00042d43d000000e1ea2a807a629b496b664cf07ad7c08d", "cert": { "san": [ "claimcredits.online", "www.claimcredits.online" ], "issuer": "Let's Encrypt / YE2", "serial": "6d0cdf7e4c04f2ed5bcf198310530308c9", "sha256": "de3cd27df35940a517fd61b341a254ede9e181b02361877cdfb516d0656a9bf4", "subject": "claimcredits.online", "valid_to": "2027-01-16T19:53:08Z", "valid_from": "2026-10-18T19:53:09Z" }, "whois": { "registrar": "HOSTINGER operations, UAB", "registrar_iana_id": "1636", "registrar_url": "https://www.hostinger.com", "created": "2025-08-22T10:20:28Z", "updated": "2026-08-06T14:32:26Z", "expires": "2027-08-22T23:59:59Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "registration": "2025-08-22T10:20:28Z", "registrar expiration": "2027-08-22T23:59:59Z", "last update of RDAP database": "2026-10-07T18:41:38Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T14:34:06Z", "mail_config": { "mx": [ "mx1.hostinger.com", "mx2.hostinger.com" ], "spf": "v=spf1 include:_spf.mail.hostinger.com ~all", "dkim": [ "hostingermail-a" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 3 }, "caa_records": { "domain": "claimcredits.online" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-24T14:29:54Z", "first": "2018-08-09T10:13:59Z", "changes": 4, "days_archived": 5, "scans_per_day": 0, "avg_page_bytes": 38245 }, "robots_txt": { "agents": [ "*" ], "present": true, "llms_txt": true, "sitemaps": [ "https://claimcredits.online/sitemap.xml", "https://claimcredits.online/news-sitemap.xml", "https://claimcredits.online/sitemap_index.xml" ] }, "sitemap": { "present": true, "url_count": 173 }, "social_tags": { "ogUrl": "https://claimcredits.online/", "title": "Home - Claim Credits", "ogType": "website", "robots": "index, follow, max-snippet:-1, max-video-preview:-1, max-image-preview:large", "ogTitle": "Home - Claim Credits", "generator": "WordPress 6.8.11", "ogSiteName": "claimcredits.online", "description": "We provide easy-to-use tools and guides to help American families discover and claim every tax credit they deserve.Updated for 2026 and completely free to use.", "twitterCard": "summary_large_image", "canonicalUrl": "https://claimcredits.online/", "ogDescription": "We provide easy-to-use tools and guides to help American families discover and claim every tax credit they deserve.Updated for 2026 and completely free to use." }, "trackers": { "requests": 46, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 1 }, { "name": "Jetpack", "company": "Automattic", "country": "US", "category": "Site Analytics", "requests": 2 } ] }, "mixed_content": { "no_sri": [ "https://www.googletagmanager.com/gtag/js", "https://cdn.tailwindcss.com/", "https://stats.wp.com/e-202643.js", "https://c0.wp.com/c/6.8.11/wp-includes/js/dist/hooks.min.js", "https://c0.wp.com/c/6.8.11/wp-includes/js/dist/i18n.min.js" ], "upgrade_insecure": true, "third_party_scripts": 5 }, "status": { "up": true, "code": 200, "timings": { "dns": 42, "tls": 39, "wait": 6, "connect": 7, "download": 77 }, "response_ms": 171 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 328535, "co2_grams": 0.012, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "162.159.25.42", "host": "ns2.dns-parking.com" }, { "ip": "162.159.24.201", "host": "ns1.dns-parking.com" } ], "zone": "claimcredits.online" }, "cookies": { "cookies": [ { "name": "_ga_LL8V6F3YFC" }, { "name": "_ga" } ] }, "location": { "ip": "2a02:4780:84:db4a:e781:73dd:255a:b299", "asn": "47583", "org": "Hostinger CDN", "city": "Vilnius", "country": "LT" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "claimcredits.online" }, "dns": { "A": [ "2.57.91.65", "88.222.222.195" ], "MX": [ "{\"exchange\": \"mx1.hostinger.com\", \"priority\": 5}", "{\"exchange\": \"mx2.hostinger.com\", \"priority\": 10}" ], "NS": [ "ns2.dns-parking.com", "ns1.dns-parking.com" ], "SOA": "{\"nsname\": \"ns1.dns-parking.com\", \"hostmaster\": \"dns.hostinger.com\", \"serial\": 2026102201, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 600}", "TXT": [ "v=spf1 include:_spf.mail.hostinger.com ~all" ], "AAAA": [ "2a02:4780:84:703e:7a98:7d0e:9130:f817", "2a02:4780:84:db4a:e781:73dd:255a:b299" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": "upgrade-insecure-requests", "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2a02:4780:84:b4b9:458c:6bf1:8a1f:6918", "family": 6 }, "redirects": { "chain": [ "https://claimcredits.online" ] }, "linked_pages": { "external": [ "https://stage.startertemplatecloud.com/g15/" ], "external_count": 1, "internal_count": 25 }, "whois": { "registrar": "HOSTINGER operations, UAB", "created": "2025-08-22T10:20:28Z", "updated": "2026-08-06T14:32:26Z", "expires": "2027-08-22T23:59:59Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ] }, "headers": { "headers": { "server": "hcdn", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.2.34", "content-security-policy": "upgrade-insecure-requests" } } } } ```