# PhishDestroy domain threat record: cloreai.info Content language: English Canonical HTML report: https://phishdestroy.io/domain/cloreai.info/ Machine-readable companion: https://phishdestroy.io/domain/cloreai.info/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 11:53:39 UTC - Last availability or vendor check: 2026-10-26 11:53:39 UTC - Stored record updated: 2026-10-26 20:16:40 UTC - VirusTotal detections in the stored snapshot: 7/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: celer ## Stored infrastructure - Observed IP address: 104.21.48.188 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a1780d-4d0e-759a-8ca6-2d07bfd1906c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/cloreai.info - Certificate Transparency search: https://crt.sh/?q=%25.cloreai.info - Web Archive lookup: https://web.archive.org/web/*/https://cloreai.info/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview The captured screenshot from 2026-10-26 shows a CLORE.AI-branded page headlined "The $CLORE Airdrop Is HERE!" above a prominent Connect Wallet button, with navigation for Marketplace, Docs, Bare metal, Statistics, VPN, App, Token and Support, a Login / Sign Up control, zeroed statistic tiles and a cookie notice. PhishDestroy classified the domain as a crypto wallet drainer and first saw it on 2026-10-26, two days after its 2026-10-24 registration. How the scam works The page offers a token airdrop and funnels visitors into a wallet-connection flow, the standard drainer pattern in which the connected client is prompted to sign transactions that can transfer assets to the operator. As a category risk, the airdrop lure paired with the Connect Wallet control is designed to obtain a signature directly from the visitor's own wallet. Evidence The screenshot shows the airdrop headline, the Connect Wallet button and CLORE.AI branding as observed on 2026-10-26. urlscan rated the page malicious with an ML score of 88 and a phishing verdict score of 100 on 2026-10-26, and the capture recorded a 307 redirect from plain HTTP to HTTPS. VirusTotal flagged it as malicious with ESET labelling it phishing; Spamhaus listed it under its spam category, MetaMask, SEAL and PhishDestroy's internal blocklist flagged it, and OTX carried 4 pulses, while Google Safe Browsing was not flagged on 2026-10-26. Site inspection recorded a wagmi and AppKit wallet stack with a Coinbase Wallet SDK module, Google Tag, Crisp chat and a Reddit tracker, plus 5 distinct script SHA256 hashes, one beginning f59545cb2b7c. Infrastructure Weaknesses first: DNSSEC is unsigned, no email authentication was recorded (no SPF, DKIM or DMARC), and X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP are absent, while CSP, HSTS and X-Content-Type-Options are present. TLS 1.3, AES-256-GCM, forward secrecy, ALPN h2; CAA records present. The domain was registered on 2026-10-24 through NICENIC INTERNATIONAL GROUP CO., LIMITED, with hosting fronted by Cloudflare and its WAF detected as present. What to do If you visited cloreai.info and connected a wallet or signed anything, revoke and review any token approvals, move remaining assets to a fresh wallet, and treat the exposed wallet as compromised. For defenders, block cloreai.info at the proxy, DNS and endpoint layers, and hunt for visits using the recorded script hashes. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1780d-4d0e-759a-8ca6-2d07bfd1906c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/69b7d5d9-dce0-4345-bcd2-3aa75cada0c8 Stored capture screenshot: https://i.ibb.co/Csh4HSdk/66bbaa62420e.png Cloudflare Radar screenshot (2026-10-26T12:30:06Z): https://screenshots.phishdestroy.io/cf/69b7d5d9-dce0-4345-bcd2-3aa75cada0c8.png URLScan screenshot (2026-10-26T12:03:27Z): https://screenshots.phishdestroy.io/us/01a17816-2987-756a-8c3f-495bf88c1fe7.png URLScan capture report: https://urlscan.io/result/01a17816-2987-756a-8c3f-495bf88c1fe7/ VirusTotal report: https://www.virustotal.com/gui/domain/cloreai.info Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cloreai.info Archived copy: https://web.archive.org/web/20261026115425/https://cloreai.info/ Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 20:16:40 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Csh4HSdk/66bbaa62420e.png Captured: 2026-10-26 11:53:39 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a1780d-4d0e-759a-8ca6-2d07bfd1906c.png Captured: 2026-10-26 11:53:39 UTC Source report: https://urlscan.io/result/01a1780d-4d0e-759a-8ca6-2d07bfd1906c/ - URLScan ยท 2026-10-26: https://screenshots.phishdestroy.io/us/01a17816-2987-756a-8c3f-495bf88c1fe7.png Captured: 2026-10-26 12:03:27 UTC Source report: https://urlscan.io/result/01a17816-2987-756a-8c3f-495bf88c1fe7/ SHA-256: d1ed37440a3ee55f2ebae3e126d8b44253a03291d5b14b8ca1f3d428b701a751 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/69b7d5d9-dce0-4345-bcd2-3aa75cada0c8.png Captured: 2026-10-26 12:30:06 UTC Source report: https://radar.cloudflare.com/scan/69b7d5d9-dce0-4345-bcd2-3aa75cada0c8 SHA-256: f428a0fdc6258063b35724e8a989a3bb57d84084496610d548cb4b0096ba6c1a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T11:59:01Z", "uuid": "01a1780d-4d0e-759a-8ca6-2d07bfd1906c", "scanned_at": "2026-10-26T11:53:28Z", "final_url": "https://cloreai.info/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://cloreai.info/", "from": "http://cloreai.info/", "status": 307 } ], "ip": "104.21.48.188", "domains": [ "fonts.reown.com", "cca-lite.coinbase.com", "fonts.googleapis.com", "api.ipify.org", "fonts.gstatic.com", "db.onlinewebfonts.com", "api.web3modal.org", "cdn.jsdelivr.net", "cdnjs.cloudflare.com", "pulse.walletconnect.org", "fonts.cdnfonts.com", "static.cloudflareinsights.com", "www.googletagmanager.com", "client.crisp.chat", "www.redditstatic.com" ], "ips": [ "104.20.34.30", "172.67.129.26", "104.21.72.124", "172.66.146.49", "172.64.152.241", "142.250.188.3", "172.253.122.95", "104.18.19.237", "104.17.208.5", "172.67.74.152", "104.17.25.14", "104.16.79.73", "142.251.16.97", "104.18.29.104", "151.101.65.140" ], "asns": [ "13335", "15169", "54113" ], "countries": [ "US" ], "link_domains": [ "docs.clore.ai", "opendata.clore.ai", "vpn.clore.ai", "etherscan.io", "cointelegraph.com", "markets.businessinsider.com", "finance.yahoo.com", "www.digitaljournal.com", "www.mexc.com", "www.gate.io", "bingx.com", "www.coingecko.com", "x.com", "www.youtube.com", "t.me", "discord.gg", "blog.clore.ai" ], "social": [ "https://x.com/clore_ai", "https://www.youtube.com/@cloreai", "https://t.me/clorechat", "https://discord.gg/clore-ai" ], "doc_hash": "092a2cdb42034e82b2f0fd5731ee9d0fb514575e510fdb34bca3621690fa11dd", "script_hashes": [ "f59545cb2b7c367d0f51b5e99909a00472c7451c2a4b53e0041b70b2cb7a2725", "d4fcbc32a73d9d0bc5ea474c4de51e878204c2962709329ed0ec5f4c8ecd4a53", "b70a6a76a50913f4a1e22e1c48a274f782b85e9ad5323b31cc531e9fdeadd1c4", "cf5c7963a6f7b2830439f258a3c7321d34e2e53cc2cc9e2fc6129ad8fa244a1a", "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8" ], "globals": [ "N1AvGXn", "NlQFqv", "kYydF8", "a", "__globalObject", "__TextDecoder", "__Uint8Array", "__String", "__Array", "utf8ArrayToStr", "b", "c", "d", "e", "f", "g", "h", "$crisp", "CRISP_WEBSITE_ID", "redditNormalizeEmail", "openWalletModal", "closeWalletModal", "__cfBeacon", "google_tag_data", "google_tag_manager", "dataLayer", "onYouTubeIframeAPIReady", "__p_XQFq_cache", "__p_PH3z_array", "__p_eicl_MAIN_STR_decode", "__p_eicl_MAIN_STR", "__p_mpMc_getGlobal", "__p_Ed9k_bufferToString", "__p_SBqZ_calc", "__p_CO1I_dummyFunction", "__p_CEtT_d_fnLength", "__p_qZRn_ast", "b56b9eab5d6e31e5", "abb1f7c38b", "d51f1890" ], "cookies": [ "gacfxdn1x7", "__cf_bm" ], "storage_keys": [ "wagmi.store", "@appkit/active_caip_network_id", "@appkit/active_namespace", "@appkit/connection_status", "cbwsdk.store", "@appkit/disconnected_connector_ids" ], "tls": { "san": [ "*.cloreai.info", "cloreai.info" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "cloreai.info", "protocol": "QUIC", "valid_to": "2027-01-22T18:33:27Z", "valid_from": "2026-10-24T18:33:28Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 1, "tls_valid_days": 89, "requests": 209, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 88, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericcrypto" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Crypto" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T12:33:14Z", "uuid": "69b7d5d9-dce0-4345-bcd2-3aa75cada0c8", "scanned_at": "2026-10-26T12:30:06Z", "final_url": "https://cloreai.info/", "status": 200, "history": [ { "url": "https://cloreai.info/", "status": 200 } ], "dom_hash": "cd2685183fed31d568ec39a2bb86f033ea02ea8e19dc1a2e5af1970137c76eb0", "doc_hash": "092a2cdb42034e82b2f0fd5731ee9d0fb514575e510fdb34bca3621690fa11dd", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "cloreai.info", "type": "A", "value": "172.67.136.201" }, { "name": "cloreai.info", "type": "A", "value": "104.21.48.188" }, { "name": "cloreai.info", "type": "AAAA", "value": "2606:4700:3031::6815:30bc" }, { "name": "cloreai.info", "type": "AAAA", "value": "2606:4700:3037::ac43:88c9" } ], "dnssec_valid": false, "ip": "172.67.136.201", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-24T19:13:55Z", "updated": "2026-10-24T19:14:49Z", "expires": "2027-10-24T19:13:55Z", "nameservers": [ "peyton.ns.cloudflare.com", "joselyn.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T13:29:47Z", "analysis_at": "2026-10-26T11:10:05Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 7, "suspicious": 0, "undetected": 35 }, "detections": { "CRDF": "malicious", "ESET": "phishing", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "Kaspersky": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "first_seen": "2026-10-24T19:36:16Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.48.188" }, { "ttl": 21600, "type": "NS", "value": "joselyn.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:30bc" }, { "ttl": 21600, "type": "NS", "value": "peyton.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "joselyn.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.136.201" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:88c9" } ], "dns_at": "2026-10-26T11:50:07Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.cloreai.info", "cloreai.info" ], "issuer": "Let's Encrypt / YE1", "serial": "602636ff4dfc7542a633ece5ee71980f695", "sha256": "dd12b9b8bb9baf13aa731dd1c3a5b6779acdb6afd09b791776a8742c79f8800a", "subject": "cloreai.info", "valid_to": "2027-01-22T18:33:27Z", "valid_from": "2026-10-24T18:33:28Z" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-10-24T16:00:00Z", "registration": "2026-10-24T16:00:00Z", "registrar expiration": "2027-10-24T16:00:00Z", "last update of RDAP database": "2026-10-24T19:36:05Z" }, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T12:22:00Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "cloreai.info" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T11:54:25Z", "first": "2026-10-26T11:54:25Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 60697 }, "social_tags": { "ogUrl": "https://clore.ai/", "title": "CLORE.AI - Rent GPUs for AI/ML | Decentralized GPU CloudCLORE.AI", "ogType": "website", "robots": "index, follow", "ogImage": "https://clore.ai/assets/images/clore-og-image.png", "ogTitle": "CLORE.AI - Decentralized GPU Cloud Marketplace", "ogSiteName": "CLORE.AI", "themeColor": "#000000", "description": "CLORE.AI is the world's largest decentralized GPU cloud marketplace. Rent GPUs for AI training, inference, and rendering. Pay per minute in Bitcoin or CLORE tokens.", "twitterCard": "summary_large_image", "twitterSite": "@clore_ai", "canonicalUrl": "https://clore.ai/", "ogDescription": "Rent GPUs for AI training, inference, and rendering. 11,000+ GPUs available. Pay per minute in Bitcoin or CLORE tokens." }, "trackers": { "requests": 54, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Crisp", "company": "Crisp", "category": "Customer Interaction", "requests": 3 }, { "name": "Reddit", "company": "reddit", "country": "US", "category": "Social Media", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.redditstatic.com/ads/pixel.js", "https://client.crisp.chat/l.js", "https://www.googletagmanager.com/gtag/js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 83, "wait": 188, "connect": 7, "download": 18 }, "response_ms": 297 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 261858, "co2_grams": 0.0096, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "162.159.38.43", "host": "joselyn.ns.cloudflare.com" }, { "ip": "173.245.59.221", "host": "peyton.ns.cloudflare.com" } ], "zone": "cloreai.info" }, "location": { "ip": "2606:4700:3031::6815:30bc", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "cloreai.info" }, "dns": { "A": [ "104.21.48.188", "172.67.136.201" ], "NS": [ "peyton.ns.cloudflare.com", "joselyn.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"joselyn.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418375023, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3031::6815:30bc", "2606:4700:3037::ac43:88c9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "frame-ancestors http: https:", "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3037::ac43:88c9", "family": 6 }, "redirects": { "chain": [ "https://cloreai.info" ] }, "social_presence": { "profiles": [ "https://x.com/clore_ai" ] }, "linked_pages": { "external": [ "https://docs.clore.ai/", "https://vpn.clore.ai/", "https://etherscan.io/token/0xe60201989b8628f43dc0605f585a72bcf1f1e977", "https://opendata.clore.ai/", "https://x.com/clore_ai", "https://www.youtube.com/@cloreai", "https://t.me/clorechat", "https://discord.gg/clore-ai", "https://docs.clore.ai/main/tokenomics", "https://cointelegraph.com/sponsored/special-projects/clore-ai-decentralized-supercomputing-for-all-powered-by-the-community", "https://markets.businessinsider.com/news/stocks/clore-ai-introduces-secure-cloud-unprecedented-affordability-and-anonymity-in-high-end-cloud-computing-1032338115", "https://finance.yahoo.com/news/clore-ai-introduces-secure-cloud-163000328.html", "https://www.digitaljournal.com/pr/news/accesswire/clore-ai-introduces-secure-cloud-unprecedented-affordability-and-anonymity-in-high-end-cloud-computing", "https://www.mexc.com/exchange/CLORE_USDT", "https://www.gate.io/trade/CLORE_USDT", "https://bingx.com/en/spot/CLOREUSDT", "https://www.coingecko.com/en/coins/clore-ai", "https://blog.clore.ai/" ], "external_count": 18, "internal_count": 38 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } } } } ```