clawnchbot[.]xyz

Analysis of the domain clawnchbot.xyz shows an elevated‑risk phishing infrastructure that was taken offline prior to this report. The domain was registered on February 27, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 104.21.56.59, which is advertised as belonging to AS13335 (Cloudflare, Inc.) in the United States. The authoritative nameservers are emerie.ns.cloudflare.com and james.ns.cloudflare.com, confirming that the domain is fully managed behind Cloudflare’s CDN. No TLS certificate is presented, indicating that the site served HTTP only or that SSL termination was not configured at the time of observation.

The page title returned by the web server is the generic string "Just a moment...", providing no insight into the intended victim‑facing content. Reputation checks flag the domain on a single security blocklist and it is listed as blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, reflecting a highly suspicious profile. VirusTotal scans report that 2 of 93 security vendors label the domain as malicious, reinforcing the suspicion despite the limited vendor consensus.

The current operational status is offline, which limits further behavioural observation. Defenders should continue to block the domain at perimeter security devices, monitor for any re‑registration of the same name or similar sub‑domains, and consider adding the IP address 104.21.56.59 to threat‑intel feeds if not already present. Ongoing vigilance is advised because the underlying Cloudflare infrastructure can be reused for future campaigns, and the lack of SSL makes the site vulnerable to interception and content alteration.