Claw-dex.com Credential Theft Domain: Active Crypto Drainers

PhishDestroy identifies claw-dex.com as an active credential theft domain deployed for phishing operations targeting cryptocurrency users. The domain leverages deceptive branding to trick victims into surrendering wallet credentials or private keys, enabling unauthorized fund transfers. Security monitoring confirms active redirection pathways to fraudulent login interfaces. Organizations and individuals are advised to treat this domain as hostile and block all inbound and outbound traffic immediately.

This domain was flagged by zero of 95 VirusTotal vendors at initial scan, indicating a newly weaponized infrastructure with no prior detection coverage. The domain resolves to IP address 216.150.1.129 and is registered through IONOS SE using a Let’s Encrypt SSL certificate. The domain claw-dex.com was created on February 17, 2026, making it a recent addition to the threat landscape. Current telemetry shows no inclusion on public blocklists, and domain trust scores remain critically low due to its recent creation and zero detections. The SSL certificate suggests an attempt to establish false legitimacy, while the absence of vendor flags highlights a stealth deployment strategy.

The current status of claw-dex.com is classified as active and under investigation with a high-risk profile due to its credential theft objective and lack of detection. Immediate action is required: block the domain and associated IP at the network perimeter and DNS level. Users should avoid accessing the site and report any accidental exposure. Security teams are urged to inspect proxy logs for outbound connections to 216.150.1.129 and scan endpoints for signs of credential harvesting. Implementing DNS sinkholing and updating browser blocklists is strongly recommended to prevent further compromise. Continuous monitoring of newly registered domains mimicking legitimate services is advised to preempt similar campaigns.