claudecode-win[.]com

This domain is flagged for elevated risk due to targeted brand impersonation, specifically mimicking Google infrastructure to facilitate credential theft. The threat type involves deceptive authentication portals designed to harvest login credentials under the guise of legitimate Google services, increasing the likelihood of account compromise for unsuspecting users. Analysis indicates claudecode-win.com was registered on May 28, 2026, through Spaceship, Inc. It resolves to the IP address 142.251.156.119 and employs technologies including Google Web Server, HSTS, and HTTP/3. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. Its SSL certificate is issued by Sectigo Limited. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, suggesting moderate but concerning detection coverage. Mitigation against this brand impersonation threat involves implementing strict domain validation policies, particularly for domains mimicking Google’s naming conventions. Organizations should monitor for unauthorized access attempts originating from 142.251.156.119 and domains registered through Spaceship, Inc. with recent creation dates. End users should be trained to verify URL authenticity before entering credentials, especially when redirected from unexpected sources. Enforcing multi-factor authentication (MFA) can reduce the impact of credential theft, while security teams should prioritize blocking domains with low vendor detection but confirmed impersonation activity.