clawpower[.]vip

The domain clawpower.vip was registered on March 23 2026 through NameCheap, Inc. It resolves to the IP address 188.114.97.3, which belongs to CloudFlare, Inc. The authoritative nameservers are janet.ns.cloudflare.com and logan.ns.cloudflare.com, indicating the use of CloudFlare’s DNS and CDN services. An SSL certificate issued by Let’s Encrypt (E8) secures the site, and the HTTP response is a permanent redirect (301) to a page titled “New API”. These infrastructure elements are typical of fast‑deployment phishing campaigns.

Threat intelligence sources flag the domain as an investment‑related scam. AlienVault OTX cites the domain in two separate pulses, and VirusTotal reports a single security vendor flagging the site out of ninety‑five scanned. The Gridinsoft trust score of 0 out of 100 underscores the malicious reputation. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high‑risk phishing operation.

While the page title “New API” provides no direct indication of the victim‑facing content, the combination of a freshly registered domain, CloudFlare‑hosted infrastructure, and the investment‑scam label suggests the site is likely used to lure users into submitting financial credentials or cryptocurrency wallet details. The exact brand or service being impersonated has not been disclosed in the available intelligence, leaving the specific lure ambiguous.

Defenders should immediately block DNS resolution for clawpower.vip and any sub‑domains, enforce URL filtering, and monitor outbound traffic for connections to 188.114.97.3. Given the active blocklist entries, integrating the domain into enterprise threat‑intelligence feeds will prevent user exposure. Continuous re‑scanning on VirusTotal and correlation with endpoint logs are recommended to detect any payload delivery that may emerge from the “New API” endpoint.