openid-info[.]click

This domain, openid-info.click, is flagged as an active phishing infrastructure targeting OpenID credentials. Registered on June 1, 2026, through Global Domain Group LLC, the domain currently resolves to IP address 188.114.96.3, hosted on Cloudflare’s network in Canada. Analysis indicates the use of Cloudflare nameservers (gwen.ns.cloudflare.com and hassan.ns.cloudflare.com) and a Let’s Encrypt SSL certificate (YE2), which are common in phishing campaigns to obscure hosting origins and present a false sense of legitimacy. The domain is currently returning an HTTP 404 status, though the page title 'Maintenance Underway — Our Website' suggests an attempt to mask malicious activity behind a maintenance facade. This tactic is frequently employed to avoid immediate detection while the infrastructure remains operational for targeted attacks. Security vendors have flagged the domain, with 5 out of 91 detections on VirusTotal, and it appears on one security blocklist. Additionally, AlienVault OTX records the domain in a threat intelligence pulse, further corroborating its malicious classification. While the exact phishing kit or targeted brand is not yet confirmed, the domain name and context imply a focus on OpenID credential theft, likely impersonating authentication portals. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS and network levels. Monitoring for related subdomains or IP associations is recommended, as the infrastructure may be reused for additional campaigns. The domain remains active as of July 12, 2026, and no takedown efforts have been observed.