clawdevent[.]net

This domain, clawdevent.net, is identified as an impersonation phishing site designed to mimic legitimate social media authentication portals. Analysis indicates the page title "X. It’s what’s happening / X" directly replicates branding elements of a major social media platform, suggesting an intent to deceive users into entering credentials through fraudulent login interfaces. The infrastructure employs multiple authentication-related technologies, including Google Sign-in and Apple Sign-in, to enhance the illusion of legitimacy while capturing submitted credentials for unauthorized access. Evidence supporting this assessment includes detection by 2 of 95 security vendors on VirusTotal, presence on 3 independent security blocklists, and registration through PDR Ltd. d/b/a PublicDomainRegistry.com on March 01, 2026. The domain resolves to the IP address 188.114.97.3, hosted on Amazon Web Services infrastructure, and utilizes Node.js with Express framework to serve dynamic content. Additional technologies detected include Apple iCloud Mail, Salesforce, and Stripe, which may be exploited to process fraudulent transactions or exfiltrate stolen data. Users who visited clawdevent.net should immediately revoke any entered credentials from all associated accounts, particularly social media and email services. Enable multi-factor authentication where available and monitor linked accounts for unauthorized activity. Security teams are advised to block the domain and its resolving IP (188.114.97.3) at the network perimeter. Given the domain's current offline status, continuous monitoring for reactivation attempts is recommended, as threat actors frequently redeploy phishing infrastructure under similar naming conventions.