clawnchchecker[.]org

Analysis of clawnchchecker.org indicates a generic phishing domain targeting users of the social media platform identified in the page title as 'x.com/'. The domain was registered on February 27, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently offline. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers jermaine.ns.cloudflare.com and reza.ns.cloudflare.com, resolving to IP 172.67.135.18 located in the US. No SSL certificate was present at the time of assessment, increasing the risk of credential interception or session hijacking over unencrypted connections.

The domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, suggesting prior malicious activity. VirusTotal reports one detection from 93 security vendors, though the absence of additional context limits the conclusiveness of this signal. The page title 'x.com/' directly references the target platform, but the exact phishing methodology—whether credential harvesting, fake verification prompts, or other social engineering tactics—remains unconfirmed due to the domain's offline status. Defenders should treat this domain as a confirmed phishing indicator.

Recommended actions include blocking the domain and IP at network perimeter controls, updating endpoint protection signatures, and monitoring for related infrastructure (e.g., Cloudflare-hosted domains with similar naming patterns). Given the domain's registration age and blocklist presence, retrospective analysis of logs for connections to 172.67.135.18 or clawnchchecker.org may identify compromised accounts or lateral movement attempts. No evidence links this domain to a specific phishing kit or campaign, and further attribution requires additional telemetry.