Scan report · 19 days agoScanned from TRPublic

claude-tools.com

104.21.89.16AS13335 · US

Suspicious: page delivers an executable (https://claude-tools.co…594e7745be0/Claude.dmg)

brand impersonation (Anthropic, high); content suppressed for non-Windows visitors - halves in unrelated scripts, not a gate

Engine tags

Verdict

3 of 9 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 2.0 s · 2 requests

01 · Visitor opensclaude-tools.com

02 · Page shown

Download Claude | Claude by Anthropicstyled as Anthropic · high

03 · OutcomeCredential phishingA login page wearing a brand it does not own.

Dangerous — confirmed threat

Automated

It presents itself as Anthropic while being hosted somewhere Anthropic does not own. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingPage delivers an executable under a document pretext

https://claude-tools.com/r77q582/_downloads/f7e9a85e-ec4e-4e61-95b3-e594e7745be0/Claude.dmg · brand impersonation (Anthropic, high); content suppressed for non-Windows visitors - halves in unrelated scripts, not a gate

The page presents itself as a document but its button downloads a program to run, not a document to read.

Analyst noteConfirm what the download actually serves. A document workflow that delivers an installer is the tell; the file itself may be signed and clean.

SupportingBrand impersonation detected

Anthropic · high

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteHigh confidence: the host wears the brand's name and the brand does not own it.

Infrastructure

IP: 104.21.89.16CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=YE1, O=Let's Encrypt, C=US · expires Dec 10, 2026

WHOIS

Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
Created: Sep 11, 2026
Expires: Sep 11, 2027
Nameservers: janet.ns.cloudflare.comkeaton.ns.cloudflare.com

61 malicious14 suspicious

Hashes & fingerprints

Page Hash74578d682db9617964991c2335565e6ff0aec16c7c632fe499085d350fe2657d DOM Hash27e12bc3c11e3af956fe7cd3fee2370948842641f70030b91ca4c5703c864876 Screenshot pHashc4ff01ff0456bb01 JARM27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint155661F6541C1F9B2ACDB9061BE6D4807E4187DB Cert IssuerCN=YE1, O=Let's Encrypt, C=US

Page capture

Live

Title “Download Claude | Claude by Anthropic” · brand shown: Anthropic (high)

Visit Site

Engines

9 · time to verdict