clashios[.]com

This domain, clashios.com, is identified as a phishing infrastructure targeting users of Clash and Shadowrocket VPN proxy services. The site presents itself as a recommendation platform for VPN nodes, specifically advertising "Clash 机场推荐（2026 最佳 Clash、Shadowrocket 节点)" in its page title. Such domains typically aim to harvest login credentials, payment details, or distribute malicious configuration files that reroute user traffic through attacker-controlled proxies. The content suggests a focus on Chinese-speaking users seeking VPN solutions, increasing the risk of exposure to fraudulent proxy services or malware-laden node lists. Analysis indicates the domain was registered on June 08, 2026, through NameSilo, LLC, and resolves to the IP address 149.28.27.230. It is currently flagged by 3 security blocklists and detected by 2 out of 95 security vendors on VirusTotal. The domain appears in 4 threat intelligence pulses on a major threat-sharing platform, further corroborating its malicious classification. The use of a Let's Encrypt SSL certificate is consistent with phishing campaigns that leverage free certificates to appear legitimate while evading basic security warnings. Users who visited clashios.com should immediately revoke any credentials or payment details entered on the site. Devices used to access the domain should be scanned for malware, particularly if VPN configuration files were downloaded. Network-level monitoring for connections to 149.28.27.230 is recommended to identify potential compromise. Affected users should also review financial statements for unauthorized transactions, as phishing sites of this nature often target payment information. The domain has since been taken offline, but related infrastructure may remain active under different names.