openclawtool[.]ai

The domain openclawtool.ai is currently active and returns an HTTP 301 redirect. It was registered on 2026-05-02 through GNAME.COM PTE. LTD. and resolves to IP 188.114.97.3, which belongs to a CDN provider located in Canada. The host presents a TLS certificate issued by Let’s Encrypt (E7) and enforces HSTS, supporting HTTP/3. MX records point to mx1.privateemail.com and mx2.privateemail.com, indicating use of a third‑party mail service. Reputation data shows a Gridinsoft trust score of 0/100 and the domain appears on three public blocklists, being blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans report three detections out of ninety‑one scanners. These indicators collectively suggest the domain is being used for a generic phishing campaign. The exact content hosted at the URL has not been analyzed, so the specific lures or credential‑collection mechanisms remain unknown. Defenders should block the domain at perimeter firewalls and DNS filters, monitor for outbound connections to the associated IP, and add the domain to internal threat‑intel feeds. Continuous re‑scanning is recommended to capture any changes in payload or hosting infrastructure.