proposal-clawdbotatg[.]com

Analysis of proposal-clawdbotatg.com as of July 24 2026 shows that the domain was registered on March 06 2026 through NiceNIC International Group Co., Limited. DNS resolution points to the Cloudflare edge address 188.114.96.3, which is advertised as belonging to AS13335 Cloudflare, Inc. and is geolocated to the United States. The authoritative name servers are adam.ns.cloudflare.com and danica.ns.cloudflare.com, confirming that the domain is fully hosted on Cloudflare infrastructure. No TLS certificate was observed during the scan, and the sole HTTP response returned the page title “Just a moment…”, which is typical of Cloudflare’s interstitial challenge page rather than a legitimate brand landing page.

The domain has been actively flagged by multiple security services. It appears on three public blocklists, and it is listed as blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal identified a single positive detection out of ninety‑four scanners, indicating that at least one AV engine flagged the resource as malicious. The current operational status is reported as offline, suggesting that the site is no longer serving content, but the historical indicators remain relevant for threat‑intel correlation.

Given the combination of recent registration, Cloudflare‑only hosting, absence of a valid SSL certificate, and explicit blocklist entries, the infrastructure is consistent with a generic phishing or scam deployment. However, the exact payload, targeted brand, or victim interaction flow cannot be confirmed because no page content beyond the title has been captured. Defenders should continue to deny network connections to the domain, add it to URL filtering and DNS sinkhole policies, and monitor for any resurgence of activity from the associated IP address or Cloudflare name servers. Ongoing telemetry collection from proxy logs and endpoint detections will help validate whether the single VirusTotal flag corresponds to a broader campaign.