cludymainas.com: Fake Login Stealer Spotted — Check Now Before

PhishDestroy identifies cludymainas.com as an active generic phishing domain with a high-risk crypto-drainer threat. This domain was flagged as a generic phishing page on May 01, 2026, just hours after its creation, and remains unblocked with a 2/95 VirusTotal detection score. Resolving to 188.114.96.3 via Let’s Encrypt SSL, it is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently evades all mainstream blocklists and security engines.

Technical indicators confirm this domain is a live credential-harvesting page designed to siphon crypto wallet logins. The unusually short domain age combined with zero VirusTotal detections indicates an actively evolving campaign that has not yet been widely profiled. The IP address 188.114.96.3 hosts multiple low-reputation domains, and the Let’s Encrypt certificate suggests attackers are leveraging trusted SSL to bypass browser warnings. Registrar data ties the domain to a high-volume provider known for poor abuse controls, increasing the risk of rapid domain churn and evasion.

Mitigation requires immediate verification on PhishDestroy. Users should avoid entering any credentials or wallet connections on cludymainas.com. If already interacted with, disconnect wallets, revoke permissions, and scan for malware. Report the domain to PhishDestroy seed 66eeda to accelerate takedown. Security teams should block 188.114.96.3 and monitor NICENIC domains for similar patterns. This campaign demonstrates the growing use of infant domains with clean SSL to harvest crypto credentials, highlighting the need for real-time verification over reputation-based blocking.