claim[.]rnonad[.]net

Analysis indicates that claim.rnonad.net is an active brand‑impersonation infrastructure targeting Google users with a crypto‑scam vector. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 172.67.200.160, which is announced by AS13335 Cloudflare, Inc. in the United States. DNS is served by isaac.ns.cloudflare.com and samara.ns.cloudflare.com, and the site negotiates HTTP/3 over TLS. The presented certificate is issued by Google Trust Services under the WE1 profile, a mismatch that suggests deliberate certificate spoofing to increase perceived legitimacy.

An HTTP 403 response is returned for the root request, and the page title observed in the limited crawl reads “YouTubeRU — Смотрите YouTube без зависаний,” indicating a possible content redirection to a Russian‑language YouTube façade. Reputation checks show a Gridinsoft trust score of 0 / 100 and only two of ninety‑three VirusTotal scanners flag the domain, reflecting limited detection coverage. PhishDestroy has already blocked the domain and it appears on a single external security blocklist. The combination of a zero trust score, low detection breadth, and the use of a Google‑issued certificate aligns with a high‑risk classification.

Defenders should immediately deny outbound connections to 172.67.200.160 for any user‑initiated traffic that references claim.rnonad.net, enforce strict TLS certificate validation to reject mismatched organizational names, and add the domain to internal URL filtering and DNS sink‑hole lists. Continuous monitoring of Cloudflare edge IP reputation for the associated ASN is advised, as well as logging of any HTTP 403 responses that may indicate attempted access. Because the exact payload and phishing page content have not been publicly disclosed, threat‑hunting teams should look for anomalous authentication attempts or crypto‑payment redirects originating from this host.