openclawxonline[.]fun

The domain openclawxonline.fun is currently active and classified as a credential theft operation. Analysis indicates this infrastructure is designed to harvest user login credentials, likely through deceptive login portals or fraudulent account verification prompts. The domain remains operational as of the latest verification, posing an ongoing risk to unsuspecting users. Infrastructure analysis reveals the domain was registered on April 27, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.198.25, hosted on Cloudflare’s network (AS13335). The domain lacks an SSL certificate, increasing the likelihood of plaintext credential transmission. It is flagged by 4 of 95 security vendors on VirusTotal and appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. The absence of encryption and its presence on multiple threat intelligence feeds further corroborate its malicious intent. Current status confirms openclawxonline.fun remains active, with no takedown or mitigation measures observed. Users are advised to block the domain at the network level and avoid any interaction with its content. Organizations should update web filtering rules to include this domain and its associated IP address. Individuals who may have entered credentials on this site should immediately reset passwords for all potentially compromised accounts and enable multi-factor authentication where available. Monitoring for unauthorized access attempts is strongly recommended.