dash[.]clash[.]id

This domain, dash.clash.id, is flagged as a high-risk generic phishing threat as of July 12, 2026, and remains active. The domain was registered on April 27, 2026, through PT Dewabisnis Digital Indonesia, a relatively recent registration that aligns with its malicious use. It resolves to IP address 142.251.127.121, located in the United States and hosted by Google LLC, with nameservers alexandra.ns.cloudflare.com and emerson.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the WR3 hierarchy, and the page title is "Dashboard - Clash ID," indicating a possible impersonation of a service or platform named Clash ID, though the exact brand targeted is not confirmed beyond this title. Technology analysis reveals the use of Blogger, Java, Python, Firebase, OpenGSE, SweetAlert2, and jsDelivr, suggesting a complex stack that may include client-side scripting and backend infrastructure. The domain appears on one security blocklist and is blocked by PhishDestroy, with a Gridinsoft trust score of 0 out of 100, reflecting strong negative reputation signals. VirusTotal data shows 3 out of 91 security vendors flagging this domain, indicating partial detection across the security community. The HTTP status code is 200, confirming the site is live and serving content. Defenders should treat this domain as an active phishing threat, monitor for any changes in IP or nameserver records, and block access at the network level. The exact phishing payload or landing page content has not been analyzed, so caution is warranted when interacting with the domain. Given the low detection rate and recent registration, this domain may still be in early stages of a campaign, and organizations should update threat intelligence feeds accordingly.