openclawaix[.]fun

This domain is flagged for elevated-risk brand impersonation targeting Solana, a cryptocurrency platform. The threat involves presenting a fraudulent token analytics interface under the guise of "OpenClaw AI — Solana Token Analytics," likely intended to deceive users into disclosing wallet credentials or interacting with malicious smart contracts. Analysis indicates the domain is engineered to exploit trust in Solana’s ecosystem, potentially facilitating cryptocurrency theft or unauthorized transactions.

Infrastructure analysis reveals the domain was registered on April 13, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.176.17 and is protected by Cloudflare, masking its origin infrastructure. Security vendors on VirusTotal flagged the domain at a rate of 16/95, while Gridinsoft assigned a trust score of 1/100. The domain appears on two security blocklists and is actively blocked by PhishDestroy and Maltrail. Technologies detected include Cloudflare Browser Insights and HTTP/3, suggesting an attempt to mimic legitimate web services.

Mitigation requires immediate action from security teams and end-users. Network-level blocking of the domain and its resolving IP (172.67.176.17) is advised to prevent access. Cryptocurrency wallet holders should verify all token analytics platforms via official Solana channels before interaction. Organizations should monitor for credential submissions or wallet connection attempts to this domain in logs. Given the domain’s offline status, continuous monitoring for re-registration or re-emergence under similar naming conventions is critical to preempt further abuse.