opengradient[.]info

This domain, opengradient.info, is under investigation for credential harvesting phishing activity targeting users through deceptive login interfaces. The site mimics legitimate services to trick visitors into submitting sensitive credentials, such as usernames, passwords, or authentication tokens. Analysis of the domain's infrastructure and content indicates a focus on social engineering tactics, likely leveraging cloned web pages to appear authentic to unsuspecting users. Evidence supporting this assessment includes the domain's registration through NiceNIC International Group Co., Limited, a registrar frequently associated with low-reputation domains. The domain was created on February 21, 2026, suggesting a recent and potentially short-lived operation. It appears on 1 security blocklist, though it has not yet been flagged by VirusTotal, with 0/95 detections. The domain resolves to the IP address 188.114.97.3 and employs technologies such as Cloudflare, jsDelivr, and Google Analytics, which are commonly used to obfuscate malicious activity and track victim interactions. The SSL certificate is issued by Google Trust Services, adding a layer of perceived legitimacy to the phishing site. Users who visited opengradient.info should take immediate action to mitigate potential risks. If credentials were entered on the site, reset passwords for all accounts where the same credentials may have been reused, prioritizing email, financial, and work-related accounts. Enable multi-factor authentication (MFA) on all critical services to prevent unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins or transactions, and report any anomalies to the respective service providers. Additionally, scan local devices for malware, as phishing sites may deploy malicious scripts or payloads. Exercise caution with unsolicited communications, particularly those urging urgent action or requesting sensitive information.