op-net[.]org

The domain op-net.org has been identified as a credential theft operation designed to harvest user login credentials through deceptive Cloudflare verification pages. Analysis indicates this is not a generic phishing attempt but a targeted effort to impersonate authentication prompts, likely to capture sensitive account information. The domain is currently offline, though its infrastructure remains a potential threat for future malicious activity. Infrastructure analysis reveals op-net.org was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 20, 2026, an unusually forward-dated registration that may indicate an attempt to evade detection or prolong operational use. The domain resolves to the IP address 188.114.96.3 and is flagged by only 1 of 95 VirusTotal security vendors, suggesting low initial detection rates. It appears on a single security blocklist and has a Gridinsoft trust score of 0/100, reinforcing its malicious classification. Detected technologies include Cloudflare Browser Insights and HTTP/3, which may have been leveraged to enhance the legitimacy of the phishing pages and obscure traffic analysis. Current status indicates the domain has been taken offline, though the underlying infrastructure could be reactivated or repurposed for similar attacks. Organizations are advised to block the domain and its associated IP (188.114.96.3) at the perimeter level, including firewalls and DNS filters. Security teams should monitor for any re-emergence of op-net.org or related domains registered through the same registrar. End-users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, particularly those involving cloud services or authentication portals. Proactive hunting for indicators of compromise, such as unusual login attempts or unauthorized access, is recommended.