Claude

Software & cloud United Statesclaude.aiBy Anthropic
Cert findings · 24 h
1
Cert findings · 7 days
4
3 reported or listed · 1 on phishing hosts
Registered lookalikes
341
17 listed by a source or an address list
Official domains
5
verified from Claude's own sites and records

Certificate findings for Claude

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Claude's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 9 findings, grouped by hostname

  1. r238ns9e7mhj929.claudecode-cn.com CN · AS24429 · Zhejiang Taobao Network Co.…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 33 d ago
    DetailsHide
    Hostname
    r238ns9e7mhj929.claudecode-cn.com
    First seen
    2026-11-05 09:04 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 47.246.22.198.
    1. Phishing-host list fetched with the address
    2. Resolved to 47.246.22.198
    Brand
    Claude
    Addresses
    47.246.22.198 · China · AS24429 Taobao - Zhejiang Taobao Network Co.,Ltd
    Domain
    claudecode-cn.com
    Registered
    2026-10-03 · Gname 095 Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

  2. www.anthropic-beta-ads.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesUnder anthropic-beta-ads.com, listed by USOMMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    www.anthropic-beta-ads.com
    First seen
    2026-11-03 03:36 UTC
    First published
    2026-11-03 04:56 UTC
    Listing
    USOM listed it 2026-10-07 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:43 UTC
    DNS
    Resolves · checked 2026-11-05 05:06 UTC
    Listed
    USOM, listing anthropic-beta-ads.com and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-03 02:35 UTC to 2027-02-01 02:35 UTC
    Logged 2026-11-03 03:33 UTC in IPng Networks Halloumi2027h1, entry 344,150,068
    SHA-256 3beab39758f333132a9a6f6f2797b3115cecd1e2b81cdca83cd5d00ffd59f20d
    Public key SHA-256 04f831a11e5dcb77525873e6d5dacf0d9fb9a3556853fbd847067c73680538f5
    Brand
    Claude
    Addresses
    216.150.1.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.150.16.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.193, 216.150.16.193): a cloud provider. It rents servers and addresses to its customers.
    Domain
    anthropic-beta-ads.com
    Registered
    2026-06-30 · Ultahost, Inc.
    MX
    Receives mail at mx1.improvmx.com, mx2.improvmx.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  3. anthropic-beta-ads.com US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by USOMMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    anthropic-beta-ads.com
    First seen
    2026-11-01 06:36 UTC
    First published
    2026-11-01 06:58 UTC
    Listing
    USOM listed it 2026-10-07 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:43 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-01 05:36 UTC to 2027-01-30 05:36 UTC
    Logged 2026-11-01 06:35 UTC in DigiCert Wyvern2027h1, entry 371,882,535
    SHA-256 1ef6be034872a18c55b4d9c6ef8e1b4b001bed64797c9865ecb9c96460b172a1
    Public key SHA-256 189085a0c9d042f09e5ceee991f305a7f9f9149d801d2ea46a23bc12318e7e00
    Brand
    Claude
    Addresses
    216.150.1.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    anthropic-beta-ads.com
    Registered
    2026-06-30 · Ultahost, Inc.
    MX
    Receives mail at mx1.improvmx.com, mx2.improvmx.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  4. claudecode.jp US · AS16509 · Amazon.com, Inc.
    ReportedAmazon Web ServicesReported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    claudecode.jp
    First seen
    2026-10-30 19:51 UTC
    First published
    2026-10-30 20:43 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 20:47 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-30 18:49 UTC to 2027-01-28 18:49 UTC
    Logged 2026-10-30 19:48 UTC in Google PlumbersArms2027h1, entry 528,399,125
    SHA-256 171baa83a9f45b9f35f2bf6c69517ab03a99c8c63cac92003d1c7d8630b3490e
    Public key SHA-256 c30afb95bd4108f44a826082f9e80309f18527655e94c49d7befb7185ab88dbe
    PhishDestroy
    Brand
    Claude
    Addresses
    216.198.79.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.198.79.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    claudecode.jp
    MX
    Receives mail at sv14080.xserver.jp
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  5. www.claudecode.jp US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesUnder claudecode.jp, reported by PhishDestroyMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.claudecode.jp
    First seen
    2026-10-29 10:50 UTC
    First published
    2026-10-29 10:53 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Reported
    PhishDestroy, listing claudecode.jp and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 09:47 UTC to 2027-01-27 09:47 UTC
    Logged 2026-10-29 10:46 UTC in Google PlumbersArms2027h1, entry 504,975,272
    SHA-256 02ef436fa3a7dcfbf78639ee7803a2ca5893521a3cc50302cf89c18813aa85ba
    Public key SHA-256 e073e6b9376bdb173815a9c8206944c14fe72445567e014cf08658be2e610e09
    PhishDestroy
    Brand
    Claude
    Addresses
    216.150.1.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.150.16.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.193, 216.150.16.193): a cloud provider. It rents servers and addresses to its customers.
    Domain
    claudecode.jp
    MX
    Receives mail at sv14080.xserver.jp
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  6. www.anthropic-sponsored.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesUnder anthropic-sponsored.com, listed by USOMMX absentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    www.anthropic-sponsored.com
    First seen
    2026-10-29 02:30 UTC
    First published
    2026-10-29 02:34 UTC
    Listing
    USOM listed it 2026-10-07 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:43 UTC
    DNS
    Resolves · checked 2026-11-05 02:42 UTC
    Listed
    USOM, listing anthropic-sponsored.com and the names under it
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-29 01:29 UTC to 2027-01-27 01:29 UTC
    Logged 2026-10-29 02:28 UTC in DigiCert Wyvern2027h1, entry 341,949,941
    SHA-256 29eb69f50898bf16acf39fbdc599e1c1a8e0091db467819afba1d271ab798baa
    Public key SHA-256 64964e5861a335f6837a26b872dbf9f32cd8bb99ca2e55be93b562f4dd32df00
    Brand
    Claude
    Addresses
    216.150.1.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.150.16.193 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.193, 216.150.16.193): a cloud provider. It rents servers and addresses to its customers.
    Domain
    anthropic-sponsored.com
    Registered
    2026-06-25 · Ultahost, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 06:44 UTC

    Suggest a correction

  7. anthropic-sponsored.com US · AS16509 · Amazon.com, Inc.
    ListedAmazon Web ServicesListed by USOMMX absentSPF ~allDMARC policy noneRegistered 4 mo ago
    DetailsHide
    Hostname
    anthropic-sponsored.com
    First seen
    2026-10-28 01:46 UTC
    Listing
    USOM listed it 2026-10-07 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:43 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Listed
    USOM
    1. Listed by USOM
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-28 00:42 UTC to 2027-01-26 00:42 UTC
    Logged 2026-10-28 01:41 UTC in Google ParcelYard2027h1, entry 480,812,409
    SHA-256 0462bc335de12ed531708e2ae1a8a95c27d90e606e4cb930bebde7957ac4f160
    Public key SHA-256 619c670d730a322e8c465782135dc7dbc1e76281f0df141dd957a82493c075ef
    Brand
    Claude
    Addresses
    216.150.1.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (216.150.1.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    anthropic-sponsored.com
    Registered
    2026-06-25 · Ultahost, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 06:44 UTC

    Suggest a correction

  8. www.claude-code-experts.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    www.claude-code-experts.com
    First seen
    2026-10-27 01:07 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.57.91.91
    3. Latest DNS check
    Certificate
    Logged in DigiCert Wyvern2027h1, entry 318,789,457
    SHA-256 ba25d389c1755788823f88abe6fba582ca1f545645e764f52ae116f48518d2fc
    Brand
    Claude
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    claude-code-experts.com
    Registered
    2026-05-14 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:25 UTC

    Suggest a correction

  9. claude-code-experts.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    claude-code-experts.com
    First seen
    2026-10-27 01:06 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Resolved to 2.57.91.91
    3. Latest DNS check
    Certificate
    Logged in DigiCert Wyvern2027h1, entry 318,789,457
    SHA-256 ba25d389c1755788823f88abe6fba582ca1f545645e764f52ae116f48518d2fc
    Brand
    Claude
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    claude-code-experts.com
    Registered
    2026-05-14 · HOSTINGER operations, UAB
    MX
    Receives mail at mx1.hostinger.com, mx2.hostinger.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:25 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Claude when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Software & cloud

All brands →