clawforge[.]app

On 22 July 2026, the domain clawforge.app was observed to be taken offline after being identified as a generic phishing infrastructure. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted on an Amazon Web Services address (AS16509, Amazon.com, Inc.) located in Germany, resolving to 63.176.8.218. The authoritative name servers are dns1.p04.nsone.net through dns4.p04.nsone.net, indicating use of the NSONE managed DNS platform. No HTTPS certificate was presented, implying the site operated solely over HTTP.

The page title returned by the web server was “ClawForge | Forge the Swarm”, but the content of the page has not been publicly archived, leaving the exact lure or credential‑capture mechanism unknown. Threat‑intelligence feeds have placed clawforge.app on a single blocklist, specifically PhishDestroy, and VirusTotal recorded four positive detections out of ninety‑three scanned scanners, confirming that multiple security engines flagged the domain as malicious. The relatively low detection count may reflect a brief active window before the takedown. Because the domain is already offline, active probing yields no HTTP response, yet the underlying IP remains allocated to AWS and could be reused for future campaigns.

Defenders should continue to block the IP address 63.176.8.218 at network perimeter devices, enforce DNS filtering for the domain and its NSONE name servers, and monitor the registrar NiceNIC for any rapid re‑registration attempts. Continuous observation of the AWS AS16509 block for new malicious subdomains is advised. Incident response teams that have logged any credential submissions to clawforge.app should advise affected users to rotate passwords and enable multifactor authentication. Until additional artifacts become available, the primary evidence consists of registry data, DNS configuration, the limited blocklist entry, and the modest VirusTotal detection tally.