clawmode[.]pro

The domain clawmode.pro is currently identified as a cryptocurrency voting phishing site designed to harvest wallet credentials and sensitive user data. Analysis indicates the site employs deceptive voting-themed interfaces to impersonate legitimate blockchain-based voting platforms, a tactic commonly associated with credential theft and unauthorized transaction attempts. The domain is presently offline, though prior activity suggests it was actively targeting users in the decentralized finance ecosystem. Infrastructure analysis reveals the domain was registered on February 27, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk registrations. It resolves to the IP address 172.67.209.207, which has been linked to multiple phishing campaigns. Security vendors have flagged the domain, with 7 of 95 VirusTotal engines detecting malicious activity. Additionally, clawmode.pro appears on four distinct security blocklists, including entries from major cryptocurrency security frameworks. The page title, 'Clawmode | Voting,' further corroborates the phishing theme, aligning with known tactics used to exploit trust in decentralized governance processes. Current status indicates the domain has been taken offline, though residual risk remains due to its prior activity and infrastructure. Organizations and individuals are advised to block the domain and associated IP address at the network level to prevent accidental exposure. Users who may have interacted with the site should immediately revoke any connected wallet permissions, rotate credentials, and monitor transaction histories for unauthorized activity. Proactive threat hunting is recommended to identify any lingering indicators of compromise, particularly in environments where cryptocurrency transactions are conducted.