openclawxonline[.]top

openclawxonline.top was registered on May 25, 2026 through PDR Ltd. The authoritative name servers are megan.ns.cloudflare.com and nero.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to 172.67.213.115, an IP owned by Cloudflare, Inc. and geolocated to Canada. The site serves an HTTPS certificate issued by Let’s Encrypt (entity YE1) and returns HTTP 200 for the root path. The page title observed is “$1COIN – one coin. one shot. 😎”, and the threat intelligence classifies the content as a “Fake Airdrop” campaign. VirusTotal reports 14 of 91 scanners flagging the domain, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already blocked it. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. The domain is currently active and listed with a high risk rating. No additional payload or redirection behavior has been disclosed, and the exact phishing landing page content remains unverified beyond the title. Defenders should add the domain and its associated IP to network‑level deny lists, monitor DNS queries for the Cloudflare name servers, and consider sinkholing traffic to prevent credential harvesting. Ongoing observation is advised to capture any future changes in hosting or payload delivery.