cloversaxion[.]sbs

The domain cloversaxion.sbs is identified as a high-risk phishing site specifically designed to impersonate Clovers Bank Plc, a financial institution. Analysis indicates this is a brand impersonation attack targeting users through a fake login portal, as evidenced by the page title 'Home - Clovers Bank Plc.' The domain remains active and continues to pose a significant threat to unsuspecting visitors seeking legitimate banking services. Infrastructure analysis reveals the domain was registered on September 17, 2025, through Dynadot LLC, a registrar frequently associated with malicious activity. It resolves to the IP address 198.251.84.200, hosted by FranTech Solutions in Luxembourg, an infrastructure provider commonly utilized for phishing campaigns. Detection metrics show the domain is flagged by 2 of 95 security vendors on VirusTotal, with an additional presence on one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common choice for threat actors due to its accessibility and short validity periods. These technical indicators align with established patterns of phishing infrastructure deployment. Current status confirms cloversaxion.sbs remains operational and unmitigated, continuing to serve fraudulent content. Users are strongly advised to avoid interaction with this domain and any associated links. Financial institutions and security teams should prioritize blocking this domain and its resolving IP at the network level. Individuals who may have entered credentials on this site should immediately reset passwords, enable multi-factor authentication, and monitor accounts for unauthorized activity. Proactive monitoring of newly registered domains under similar naming conventions is recommended to preempt further impersonation attempts.