openid-confirm[.]info

Analysis of openid-confirm.info indicates a high-risk phishing domain targeting OpenID authentication credentials. The domain was registered on June 1, 2026, through Web Commerce Communications Limited (WebNic.cc) and remains active as of July 12, 2026. Infrastructure analysis reveals Cloudflare nameservers (aspen.ns.cloudflare.com, kyrie.ns.cloudflare.com) and resolution to IP 188.114.97.3, geolocated to Canada under Cloudflare's network. The site returns an HTTP 404 status but displays a page titled 'Maintenance Underway — Our Website,' a common tactic to mask phishing pages during inactive periods or while evading detection. The domain is flagged by one security blocklist and appears in a single AlienVault OTX threat intelligence pulse, suggesting prior abuse. Five of 91 security vendors on VirusTotal detect the domain as malicious, though the exact nature of the payload remains unconfirmed. The SSL certificate, issued by Let's Encrypt, does not mitigate risk, as phishing domains frequently use valid certificates to appear legitimate. No specific brand impersonation or phishing kit is identified in the available data, but the domain name (openid-confirm.info) strongly implies an OpenID-themed credential harvesting scheme. Defenders should treat this domain as actively hostile, block resolution at the DNS level, and monitor for connections from internal networks. Further analysis of captured payloads or redirect chains is recommended to determine the full scope of the campaign.