testicle-claim[.]live

Analysis indicates that the domain testicle-claim.live was registered on 27 December 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently taken offline. The authoritative nameservers are anuj.ns.cloudflare.com and raquel.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. DNS resolution points to 172.217.18.4, an address owned by Google LLC (AS15169) located in the United States. The lack of an SSL certificate suggests the site was served over plain HTTP. The page title returned by the server is “Google”, matching the declared brand target of Google and confirming a brand‑impersonation intent.

The campaign is classified as a crypto scam, although no further details about the monetary mechanism are available. Threat intelligence sources provide additional context. AlienVault OTX lists the domain in a single pulse, indicating limited but existing community awareness. The domain appears on two public blocklists and has been actively blocked by PhishDestroy and ScamSniffer, reinforcing its malicious reputation. VirusTotal analysis shows that three of ninety‑three security vendors flagged the domain, which aligns with the low‑volume detection profile typical of newly created impersonation sites.

Uncertainties remain regarding the exact payload delivered to victims, the infrastructure used to collect cryptocurrency, and any post‑exploitation activity, as no sample URLs or content have been disclosed. Defenders should continue to monitor the domain’s DNS records for any re‑activation, enforce blocklist rules that include testicle-claim.live, and consider adding the IP address 172.217.18.4 to network‑level deny lists only after confirming legitimate Google services are not affected. Organizations using Google branding should educate users about the absence of SSL and the generic “Google” page title as potential indicators of fraud.