clawrot[.]app

This domain is flagged for elevated-risk brand impersonation targeting Scroll, a recognized technology platform. The threat manifests as a deceptive AI agent service, misleading users into engaging with fraudulent content under the guise of legitimate Scroll functionality. The page title, 'Clawrot | The AI Agent That Doom Scrolls So You Don’t Have To,' explicitly leverages Scroll’s branding to create a false sense of affiliation, increasing the likelihood of user interaction with malicious infrastructure. Infrastructure analysis reveals multiple technical indicators of compromise. The domain clawrot.app resolves to the IP address 35.157.26.135 and was registered through NiceNIC International Group Co., Limited on February 21, 2026. Security vendor detection on VirusTotal stands at 1 out of 95, indicating limited but present recognition of malicious intent. The domain appears on one security blocklist and is blocked by enterprise-grade security systems. Additional indicators include a Gridinsoft trust score of 0/100 and the use of Netlify hosting with HSTS enforcement, which may be employed to lend an appearance of legitimacy while masking malicious activity. Mitigation steps specific to this brand impersonation threat include immediate domain blacklisting at the network perimeter to prevent user access. Security teams should monitor for any residual DNS queries or SSL connections to 35.157.26.135, as these may indicate attempted compromise. User awareness training should emphasize the risks of interacting with unverified AI services, particularly those mimicking established brands. Organizations should also review registrar policies for domains registered via NiceNIC, as this entity has been associated with other high-risk domains. Proactive monitoring for similar impersonation attempts—such as domains using variations of 'Scroll' or 'AI agent'—is recommended to preempt further exploitation.