claim-bonus-now[.]top

claim-bonus-now.top was observed on 12 July 2026 as an active brand‑impersonation site targeting Google. The page title returned by the HTTP response is "Google", and the site presents a cryptocurrency‑related lure. The domain is listed on a single security blocklist and has been flagged by PhishDestroy. The domain was registered on 11 March 2026 through Openprovider. DNS resolution points to 142.251.154.119, an address owned by Cloudflare, Inc. (AS13335) and served from Cloudflare's network. Authoritative name servers are sonia.ns.cloudflare.com. and zac.ns.cloudflare.com., confirming the use of Cloudflare's DNS infrastructure. HTTPS is presented with a certificate issued by Google Trust Services under the WE1 label, which is a legitimate Google CA but is being used here to increase credibility. The HTTP response is a 302 redirect, and the page loads reCAPTCHA and HTTP/3, indicating a modern front‑end stack. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports a single vendor detection out of 95, reflecting limited but existent detection. Defenders should block the domain at perimeter and DNS layers, monitor for outbound connections to the associated Cloudflare IP, and alert on any TLS handshake that presents the Google Trust Services WE1 certificate from an unexpected source. Continuous scanning for similarly‑named domains registered through Openprovider and using Cloudflare DNS is advised, as the short registration window suggests a rapid‑turnover campaign. Given the high risk rating, inclusion of the domain in internal blocklists and threat‑intel feeds is recommended.