clawchemy[.]xyz

The domain www.clawchemy.xyz was registered on 11 April 2026 through Porkbun, LLC and currently resolves to the IPv4 address 216.198.79.65, which is allocated to Cypress Communications, LLC in the United States. The authoritative name servers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, and maceio.ns.porkbun.com. An SSL certificate issued by a publicly trusted certificate authority (R12) is active and the HTTP response returns status 200 with the page title “Clawchemy – Autonomous Element Discovery Engine on Base”.

Analysis shows the site is being used for a brand‑impersonation campaign targeting Base, presenting itself as an “Autonomous Element Discovery Engine” to lure victims. The page’s content and title reference Base, matching the known scam type classified as a crypto scam. VirusTotal reports that 6 of 95 security vendors flag the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on one public security blocklist and has been blocked by an external anti‑phishing list.

While the infrastructure confirms a high‑risk profile, the precise payload delivered to visitors remains unclear. No publicly available samples of the landing page’s HTML, JavaScript, or any downstream cryptocurrency address have been captured. Consequently, the exact mechanism for extracting credentials or prompting crypto transactions cannot be fully described at this time, leaving a gap in the technical fingerprint of the campaign.

Defenders should treat www.clawchemy.xyz as a malicious host and enforce blocking at network perimeter and DNS filtering layers. Continuous monitoring of outbound connections to 216.198.79.65 is advised, as well as inspection of TLS traffic to detect any encrypted command‑and‑control or payment redirects. Incident response teams should also search internal logs for any user agents that accessed the domain after 11 April 2026 and quarantine associated credentials.