clayaverse[.]xyz

The domain clayaverse.xyz was registered on February 24, 2026 through NiceNIC International Group Co., Limited and is currently listed as offline. DNS resolution points to the IP address 172.67.173.84, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The domain uses Cloudflare’s authoritative name servers earl.ns.cloudflare.com and laura.ns.cloudflare.com. No TLS certificate is observed for the site, indicating that HTTPS was not configured at the time of analysis.

The page title retrieved from the site reads "Claypals NFT Giveaway," and the intelligence categorises the operation as an investment scam employing an Airdrop Scam phishing kit. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scans reported detections from three of ninety‑three security vendors, providing modest corroboration of malicious intent. Because the site is currently taken offline, content‑level evidence such as form fields or credential‑capture mechanisms is unavailable, leaving the exact phishing workflow uncertain.

Defenders should add clayaverse.xyz to internal blocklists, monitor the associated Cloudflare IP range for any re‑registration attempts, and enforce transport‑layer security policies that reject unencrypted HTTP connections. Continuous observation of the registrar NiceNIC International Group for related registrations is also advisable, as threat actors often recycle registration services. Overall, the available infrastructure signals a purposeful malicious campaign targeting NFT‑related investors, and proactive blocking is recommended to mitigate exposure.