clasjhgg[.]com

This domain, clasjhgg.com, is flagged as a generic phishing site designed to harvest user credentials through fake login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the infrastructure aligns with credential-theft campaigns. The domain exhibits characteristics typical of phishing pages, including deceptive login forms and obfuscated scripts to evade detection, though no explicit brand impersonation (e.g., Microsoft, PayPal, or financial institutions) has been confirmed in available telemetry.

Technical indicators confirm elevated risk: clasjhgg.com is detected by 2 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, and resolves to the IP address 172.67.207.86. It appears on one security blocklist and is referenced in a single threat intelligence pulse on AlienVault OTX. Google Safe Browsing (GSB) status is not explicitly listed in available data, but the domain’s inclusion in PhishDestroy’s blocklist further corroborates its malicious classification.

As of the latest assessment, clasjhgg.com is offline, reducing immediate exposure risk. However, the domain’s infrastructure remains registered, and historical patterns suggest potential reactivation or reuse of the IP for future phishing campaigns. Organizations should maintain blocklist entries for this domain and monitor the associated IP (172.67.207.86) for renewed activity. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Network defenders are advised to review logs for connections to 172.67.207.86 or related domains registered via NICENIC INTERNATIONAL GROUP CO., LIMITED, particularly those with anomalous creation dates.