register-openclaw[.]xyz

register-openclaw.xyz was registered on March 2, 2026 through Dynadot LLC and immediately pointed to Cloudflare’s network (AS13335). The domain resolves to 172.67.157.215, uses the Cloudflare nameservers jerome.ns.cloudflare.com and ollie.ns.cloudflare.com, and serves a TLS certificate issued by Google Trust Services under the WE1 profile. Infrastructure analysis shows the site is reachable via HTTP/3 and returns a HTTP 403 response, while the rendered page title reports a 504 Gateway timeout, indicating that the front‑end is intentionally blocked or misconfigured to obscure malicious payloads.

Threat intelligence sources have placed register-openclaw.xyz on a single security blocklist and it is actively listed by PhishDestroy. VirusTotal analysis shows a single security vendor flagging the domain out of 95 scans, and the Gridinsoft trust score of 0 out of 100 reinforces the low reputation. These signals collectively point to a high‑risk phishing operation despite the limited visibility of the hosted content.

The current evidence set is incomplete. The 504 gateway message prevents direct inspection of the landing page, and only one blocklist entry is available, leaving the specific phishing lure, targeted brands, and any associated credential‑harvesting kit unknown. Continuous monitoring is required to capture any future content changes, additional detections, or expansion of the hosting footprint.

Defenders should immediately block or sinkhole register-openclaw.xyz at the DNS level and enforce outbound filtering for HTTP 403 and 504 responses originating from this IP range. Security appliances should be updated to flag any TLS connections to the Google Trust Services / WE1 certificate when presented by this host. Monitoring for newly registered domains that resolve to the same Cloudflare nameservers or share the same IP address is advised, as this pattern often precedes larger phishing campaigns.