terminalofclaw[.]top

This domain, terminalofclaw.top, has been assessed as an elevated risk credential theft site, specifically a generic phishing operation designed to impersonate the legitimate Coolify platform. The domain was created on April 27, 2026, and its page title explicitly displays "Coolify," indicating a targeted attempt to deceive users into entering sensitive credentials. PhishDestroy's analysis confirms that the site is now offline, but its prior activity and infrastructure pose significant risks to anyone who may have interacted with it.

Technical indicators paint a clear picture of malicious intent. VirusTotal data shows that 4 out of 95 security vendors flagged this domain, and it appears on 3 separate security blocklists. The domain resolves to the IP address 91.215.85.176, was registered through NameSilo, LLC, and uses a Let's Encrypt / R13 SSL certificate. Additionally, AlienVault OTX reports that terminalofclaw.top is included in 1 threat intelligence pulse, further corroborating its association with phishing campaigns. The domain's creation date is also notably in the future relative to typical analysis windows, suggesting an attempt to evade detection by using recently registered domains.

Users who encounter or have encountered terminalofclaw.top should take immediate action. Since this is a credential theft site targeting Coolify logins, anyone who entered their username and password should change those credentials immediately on the legitimate Coolify platform and enable multi-factor authentication if available. It is also advisable to scan devices for any malware that may have been delivered through the phishing page. Monitoring financial accounts and other sensitive services for unusual activity is recommended, as stolen credentials could be used for account takeover. Always verify URLs carefully before entering login information, and rely on official sources or bookmarked links rather than unsolicited emails or messages directing to login pages.