opengdp[.]com

This domain, opengdp.com, is confirmed to operate as a credential theft platform designed to impersonate official government digital portals. Analysis of the page title 'OpenGDP' and infrastructure patterns indicates an attempt to deceive users into submitting sensitive login credentials, likely targeting individuals interacting with government services or public sector platforms. The site employs social engineering tactics to mimic legitimate authentication interfaces, increasing the risk of unauthorized account access and subsequent data compromise. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on February 21, 2026, through Amazon Registrar, Inc., and resolves to the IP address 18.239.36.106. Hosting infrastructure includes Amazon Web Services components such as Amazon S3, Amazon CloudFront, and AWS Certificate Manager, suggesting a cloud-based deployment strategy. Detection metrics show the domain appears on one security blocklist, while VirusTotal reports 1 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Amazon, providing a veneer of legitimacy to unsuspecting visitors. Users who accessed opengdp.com should immediately revoke any credentials entered on the site, particularly those associated with government or financial accounts. Monitor all linked accounts for unauthorized activity, including password reset attempts or suspicious transactions. If authentication tokens or multi-factor authentication codes were submitted, disable and reissue them promptly. System administrators should add the domain and its resolved IP (18.239.36.106) to network blocklists to prevent further exposure. Given the elevated risk level and targeted nature of this campaign, affected individuals are advised to conduct a full security audit of connected devices and accounts.