clarice-note[.]com

PhishDestroy identifies clarice-note.com as an active generic phishing domain impersonating a notepad application to deploy drainer malware. The domain was registered on June 15, 2022, through NAMECHEAP INC and resolves to IP 188.114.96.3, which is currently unblocked by Google Safe Browsing (GSB) with 1/95 VirusTotal detections as of seed 9627e1. No specific drainer kit signatures have been publicly documented yet, but the domain’s infrastructure suggests an active campaign targeting unsuspecting users.

Exact technical indicators reveal this domain has no current detections despite minimal age, lacks a crowd-sourced blocklist presence, and operates with an SSL certificate issued by Google Trust Services. The registrar is NAMECHEAP INC, and the domain’s creation timestamp aligns with recent campaigns leveraging newly registered domains (NRDs) to evade detection. Its IP (188.114.96.3) shows no prior associations with known malicious infrastructure, increasing the risk of fresh abuse.

As of this report, clarice-note.com remains active and under investigation with a status of 'under_investigation' and a risk level of 'under_investigation'. Users are advised to avoid interacting with this domain, as it may harvest sensitive data or cryptocurrency. Security teams should monitor for associations with this IP and domain due to the high potential for escalation. Remaining risk is elevated given its undetected status and clean infrastructure profile.