claim-level[.]net

The domain claim-level.net was registered on August 15, 2025 through Web Commerce Communications Limited dba WebNic.cc and is currently listed as offline. Technical analysis shows the site presented a page title of "Google," matching the declared brand target of Google and the listed scam type of credential phishing. The domain resolves to the IPv6 address 2a00:1450:4001:829::2004, which maps to the Autonomous System AS15169 owned by Google LLC and geolocated to Germany. Use of a Google‑owned address is a known tactic to lend perceived legitimacy to malicious pages.

The SSL certificate presented is identified as "WE2," but no further certificate details are provided. The site’s trust score from Gridinsoft is 0 out of 100, indicating a complete lack of reputation. VirusTotal scans reported a single positive detection out of 93 security vendors, confirming at least one engine identified malicious behavior. The domain appears on four independent security blocklists and has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura.

While the exact phishing payload or landing page content has not been publicly observed, the combination of a Google‑related page title, brand impersonation, credential‑phishing classification, and low trust score strongly suggests a targeted attempt to harvest Google account credentials. Defenders should continue to block claim-level.net at DNS and proxy layers, monitor for any resurgence of the domain, and consider adding the associated IPv6 address to threat‑intel feeds. Incident response teams should also examine any authentication logs for unexpected login attempts originating from the address range 2a00:1450:4001:829::/64, as compromised credentials may be exploited shortly after the domain’s takedown.