claimnow-3k2[.]pages[.]dev

This domain, claimnow-3k2.pages.dev, is under investigation for brand impersonation targeting Telegram. Registered on April 18, 2026, through Cloudflare, Inc., the domain remains active as of July 12, 2026. Infrastructure analysis reveals it resolves to IP address 188.114.96.3 and employs Cloudflare-hosted services, including HSTS and HTTP/3 protocols. The page title, 'ClaimNow — Telegram Access,' explicitly references Telegram, aligning with the identified brand impersonation threat type. The domain is currently flagged on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100, indicating high suspicion. No vendor detections were recorded at the time of scanning, though this does not confirm legitimacy. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains. Defenders should treat this domain as suspicious pending further analysis, particularly if observed in communications or redirects linked to Telegram users. Monitoring for additional blocklist inclusions or behavioral indicators (e.g., credential harvesting patterns) is recommended. The exact content and functionality of the site remain unanalyzed, and no assumptions should be made about its operational methods beyond the provided data points.