claim-dacat[.]com

This domain, claim-dacat.com, was observed as a brand‑impersonation site targeting Cloudflare. The domain resolves to the IP address 172.67.180.98, which belongs to ASN 13335 operated by Cloudflare, Inc., and is located in the United States. Registration records show the domain was created on 21 February 2026 and was registered through MAT BAO CORPORATION. The authoritative nameservers listed are ashley.ns.cloudflare.com and yevgen.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. The site presented a TLS certificate issued by Google Trust Services under the WE1 label, indicating the use of a legitimate Cloudflare‑provided certificate.

Automated analysis detected the presence of Cloudflare infrastructure and HTTP/3 support. Security telemetry indicates that the domain appears on two blocklists, specifically PhishDestroy and ScamSniffer, and is flagged by five of ninety‑three VirusTotal scanners. Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence in malicious intent. The page title returned by the server is “Suspected phishing site | Cloudflare,” which aligns with the reported brand‑impersonation purpose. The scam type is recorded as a crypto scam, although no further details about the payload or victim interaction have been disclosed.

At the time of reporting (22 July 2026) the site was taken offline, and no active HTTP response could be retrieved. Consequently, the current availability of the phishing content cannot be confirmed, and any live‑capture of the page’s HTML is unavailable. Defenders should continue to monitor the IP address 172.67.180.98 for any re‑use by related campaigns, enforce blocklist entries for claim‑dacat.com in perimeter filters, and consider adding the domain to internal threat‑intel feeds.