# PhishDestroy domain threat record: 0penware.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/0penware.com/
Machine-readable companion: https://phishdestroy.io/domain/0penware.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 11:38:52 UTC
- Last availability or vendor check: 2026-10-26 11:42:54 UTC
- Stored record updated: 2026-10-26 20:18:56 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: aptos

## Stored infrastructure

- Observed IP address: 5.183.78.22
- Registrar in stored WHOIS data: GoDaddy.com, LLC
- Last stored HTTP status: 301
- Registration date in stored WHOIS data: 2026-08-21 00:13:53 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17803-6ec7-754f-8696-fd04eb7bd766/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/0penware.com
- Certificate Transparency search: https://crt.sh/?q=%25.0penware.com
- Web Archive lookup: https://web.archive.org/web/*/https://0penware.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot shows an AptosLabs-branded dark landing page headed Discover Exceptional Talent Before They Join, with a Trusted by 500+ Leading Companies badge, a Start Free Trial button, a How It Works button, Sign in and Request Access links, plus hiring statistics. PhishDestroy listed 0penware.com as an impersonation phishing page, first seen on 2026-10-26.

How the scam works
The page presents an AI-powered recruitment and assessment offer whose Start Free Trial, Sign in and Request Access controls invite a visitor to submit login details or business contact information. As a category risk, such an impersonation funnel is designed to capture those submitted credentials or personal data while the visitor believes they are engaging a legitimate hiring vendor.

Evidence
The screenshot supplies the observed lure copy, trust badge and performance percentages used as social proof. On 2026-10-26 urlscan's machine-learning engine scored the page malicious at 83, while VirusTotal flagged the domain as malicious with Forcepoint ThreatSeeker labelling it phishing. On 2026-10-26 Spamhaus recorded no listing and OpenOTX recorded 0 pulses, and Google Safe Browsing did not flag the domain, whereas the MetaMask and SEAL blocklists and PhishDestroy's own blocklist did list it. The redirect funnel ran from the bare address through a 307 to HTTPS and then a 301 to the www-prefixed hostname, which returned 200; site inspection shows a Next.js stack with 10 distinct script SHA256 hashes recorded for campaign pivoting, one beginning feb01c87d12a.

Infrastructure
Notable weaknesses observed on 2026-10-26: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP headers were all absent, and DNSSEC is unsigned. The registrar is GoDaddy.com, LLC with hosting recorded to Ace Host, LLC, and no WAF or firewall was indicated. TLS 1.3 with AES-256-GCM, forward secrecy and ALPN h2; SPF, DKIM and DMARC all configured; CAA records present.

What to do
If you submitted credentials or personal details on 0penware.com, change your password on the genuine AptosLabs service, enable two-factor authentication, and treat any follow-up messages as phishing. Be wary of free-trial or request-access offers arriving from this domain. Security teams should block 0penware.com at DNS and proxy layers and pivot on the recorded script hashes.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17803-6ec7-754f-8696-fd04eb7bd766/
Cloudflare Radar report: https://radar.cloudflare.com/scan/711b134a-e0ed-47de-8bfd-fad18353022b
URLQuery report: https://urlquery.net/report/c3513b3c-285d-4b61-a626-cf39469a70a2
Stored capture screenshot: https://i.ibb.co/Kckfv88h/b2e17943c5c7.png
Cloudflare Radar screenshot (2026-10-26T11:39:24Z): https://screenshots.phishdestroy.io/cf/711b134a-e0ed-47de-8bfd-fad18353022b.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/c3513b3c-285d-4b61-a626-cf39469a70a2.png
URLScan screenshot (2026-08-25T15:00:09Z): https://screenshots.phishdestroy.io/us/01a0396f-7382-747f-a4b4-e2b112a2e0f4.png
URLScan capture report: https://urlscan.io/result/01a0396f-7382-747f-a4b4-e2b112a2e0f4/
URLScan screenshot (2026-10-26T11:46:29Z): https://screenshots.phishdestroy.io/us/01a17808-751a-71ab-81d6-e414e060cec1.png
URLScan capture report: https://urlscan.io/result/01a17808-751a-71ab-81d6-e414e060cec1/
VirusTotal report: https://www.virustotal.com/gui/domain/0penware.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=0penware.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:18:56 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Kckfv88h/b2e17943c5c7.png
  Captured: 2026-10-26 11:42:54 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a17803-6ec7-754f-8696-fd04eb7bd766.png
  Captured: 2026-10-26 11:42:54 UTC
  Source report: https://urlscan.io/result/01a17803-6ec7-754f-8696-fd04eb7bd766/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a0396f-7382-747f-a4b4-e2b112a2e0f4.png
  Captured: 2026-10-26 11:38:52 UTC
  Source report: https://urlscan.io/result/01a17803-6ec7-754f-8696-fd04eb7bd766/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17808-751a-71ab-81d6-e414e060cec1.png
  Captured: 2026-10-26 11:46:29 UTC
  Source report: https://urlscan.io/result/01a17808-751a-71ab-81d6-e414e060cec1/
  SHA-256: 76cb9aa0f72429bb72d98e1e892c197f9d09a507deb4773514ed9334880e885a
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/711b134a-e0ed-47de-8bfd-fad18353022b.png
  Captured: 2026-10-26 11:39:24 UTC
  Source report: https://radar.cloudflare.com/scan/711b134a-e0ed-47de-8bfd-fad18353022b
  SHA-256: 94321dfd675705c3612f5de8f2d53d663e1fe28abc342e7a5e9be51d4a4bfee8
- URLQuery: https://screenshots.phishdestroy.io/uq/c3513b3c-285d-4b61-a626-cf39469a70a2.png
  Source report: https://urlquery.net/report/c3513b3c-285d-4b61-a626-cf39469a70a2
  SHA-256: 9fa4fb52afc2f910d5f3d8d47d59ad8b4d3cf9cbe7e74313adb7b4342aa641e5
- URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a0396f-7382-747f-a4b4-e2b112a2e0f4.png
  Captured: 2026-08-25 15:00:09 UTC
  Source report: https://urlscan.io/result/01a0396f-7382-747f-a4b4-e2b112a2e0f4/
  SHA-256: d359d7483de8b9b4c4e34996a28d73814f826d7e6495f298daa1ff643c1f1efe

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T11:59:05Z",
        "uuid": "01a17803-6ec7-754f-8696-fd04eb7bd766",
        "scanned_at": "2026-10-26T11:42:31Z",
        "final_url": "https://www.0penware.com/",
        "status": 200,
        "redirected": "parent-domain",
        "redirects": [
            {
                "to": "https://0penware.com/",
                "from": "http://0penware.com/",
                "status": 307
            },
            {
                "to": "https://www.0penware.com/",
                "from": "https://0penware.com/",
                "status": 301
            }
        ],
        "ip": "5.183.78.22",
        "domains": [
            "www.aptoslabs.co",
            "fonts.googleapis.com",
            "0penware.com"
        ],
        "ips": [
            "192.178.218.95",
            "5.183.78.22"
        ],
        "asns": [
            "15169",
            "398779"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "c93c297c622b4d93ca666d412a5fad51bf314feafa1af5e4f0893582e8233676",
        "script_hashes": [
            "feb01c87d12abdd83fa8fbb29cd09db858765441538649bd84920afa847cbef8",
            "56dc43117a7af2ec34f46020ef3e0787e38991bc503e95ccdfffb147f17d058e",
            "49071491a827219036537007b10bc405f4e667075bd454daffe809628ccf8f2a",
            "ca0f0a041492a92825e433c27560f87954008b0ec9e8eb0c770e4d7269471d9f",
            "5b95930050375e82a50152462bf86d6252c1106414210518b2dbb46c477fee09",
            "61f0fcc72a54c882ecb79fb33b52146aba83093b6e16209bbf5113cea06ccbe7",
            "5333db10d26b66f8b009a44b7f8272fd303aea6dd654c0303c9f1dfa373e1efb",
            "3fd4c84345eb2f438f0c24802c093d0170e7dfff38ea21e39cb4ef5a265a2e15",
            "97f35c1ad692bbb44c1c83ce8c339247c5b946b1d75334dff38e02d3c2b8feba",
            "66f3d6a5ab8975eb8d49f482d84fd9d77c4fe6980e560048e0fb917ee1c2bb16"
        ],
        "globals": [
            "webpackChunk_N_E",
            "__next_f",
            "_N_E",
            "next",
            "__SOCKET_IO__"
        ],
        "tls": {
            "san": [
                "0penware.com",
                "www.0penware.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "www.0penware.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-21T15:50:01Z",
            "valid_from": "2026-08-23T15:50:02Z"
        },
        "domain_age_days": 63,
        "apex_age_days": 65,
        "tls_age_days": 63,
        "tls_valid_days": 89,
        "requests": 22,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 83,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.18.0 (Ubuntu)",
            "content-type": "text/html; charset=utf-8",
            "x-powered-by": "Next.js"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T11:59:08Z",
        "uuid": "711b134a-e0ed-47de-8bfd-fad18353022b",
        "scanned_at": "2026-10-26T11:39:24Z",
        "final_url": "https://www.0penware.com/",
        "status": 200,
        "redirected": "subdomain",
        "history": [
            {
                "url": "https://0penware.com/",
                "status": 301
            },
            {
                "url": "https://www.0penware.com/",
                "status": 200
            }
        ],
        "dom_hash": "daf912d30e9f51cee7be548aa6362b7862f642e753299dd3ad2fb9c465763637",
        "doc_hash": "c93c297c622b4d93ca666d412a5fad51bf314feafa1af5e4f0893582e8233676",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "0penware.com",
                "type": "A",
                "value": "5.183.78.22"
            },
            {
                "name": "www.0penware.com",
                "type": "CNAME",
                "value": "0penware.com"
            },
            {
                "name": "0penware.com",
                "type": "A",
                "value": "5.183.78.22"
            },
            {
                "name": "www.0penware.com",
                "type": "CNAME",
                "value": "0penware.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "5.183.78.22",
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "created": "2026-08-21T02:13:53Z",
            "updated": "2026-08-21T02:13:53Z",
            "expires": "2027-08-21T02:13:53Z",
            "nameservers": [
                "ns59.domaincontrol.com",
                "ns60.domaincontrol.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T11:39:19Z",
        "analysis_at": "2026-10-26T03:37:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 2,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "Gridinsoft": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Google": "jobs",
            "BitDefender": "jobsearch"
        },
        "registrar": "GoDaddy.com, LLC",
        "created": "2026-08-21T02:13:53Z",
        "expires": "2027-08-21T02:13:53Z",
        "updated": "2026-08-21T02:13:53Z",
        "first_seen": "2026-08-21T03:32:13Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns59.domaincontrol.com"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 include:secureserver.net -all"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "NETORGFT21051981.onmicrosoft.com"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "0penware-com.mail.protection.outlook.com",
                "priority": 0
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "5.183.78.22"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns60.domaincontrol.com"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "dns.jomax.net",
                "value": "ns59.domaincontrol.com"
            }
        ],
        "dns_at": "2026-10-26T04:21:17Z",
        "jarm": "21d19d00021d21d00042d43d0000000c5f19e7e54cb3beeed93cf987598de9",
        "cert": {
            "san": [
                "0penware.com",
                "www.0penware.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6b1d8068c13ab2bd45211a7a8f76e893418",
            "sha256": "b16c10d797c70a7efd05d55460b7d1cb1761c3a5ca7143d1232d4cd5d8bcf57b",
            "subject": "www.0penware.com",
            "valid_to": "2026-11-21T15:50:01Z",
            "valid_from": "2026-08-23T15:50:02Z"
        },
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "registrar_iana_id": "146",
            "registrar_url": "http://www.godaddy.com",
            "created": "2026-08-21T02:13:53Z",
            "updated": "2026-08-21T02:13:53Z",
            "expires": "2027-08-21T02:13:53Z",
            "status": [
                "clientDeleteProhibited",
                "clientRenewProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "ns59.domaincontrol.com",
                "ns60.domaincontrol.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client renew prohibited",
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "expiration": "2027-08-21T02:13:53Z",
                "last changed": "2026-08-21T02:13:53Z",
                "registration": "2026-08-21T02:13:53Z",
                "last update of RDAP database": "2026-10-25T10:08:43Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T11:40:09Z",
        "mail_config": {
            "mx": [
                "0penware-com.mail.protection.outlook.com"
            ],
            "spf": "v=spf1 include:secureserver.net -all",
            "dkim": [
                "selector1",
                "selector2"
            ],
            "dmarc": true,
            "dkim_bits": 2048,
            "providers": [
                "Microsoft 365"
            ],
            "spf_lookups": 3
        },
        "caa_records": {
            "domain": "0penware.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T11:39:01Z",
            "first": "2013-05-21T17:48:04Z",
            "changes": 3,
            "days_archived": 8,
            "scans_per_day": 0,
            "avg_page_bytes": 2351
        },
        "social_tags": {
            "ogUrl": "https://www.aptoslabs.co/",
            "title": "AI-Powered Executive Hiring Platform",
            "ogType": "website",
            "ogImage": "https://www.aptoslabs.co/images/logo/aptoslabs-mark.svg",
            "ogTitle": "aptoslabs",
            "ogSiteName": "aptoslabs",
            "description": "Transform your recruitment process with AI-powered candidate assessments, secure invites, and comprehensive insights.",
            "twitterCard": "summary_large_image"
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 301,
            "timings": {
                "dns": 23,
                "tls": 153,
                "wait": 124,
                "connect": 141,
                "download": 0
            },
            "response_ms": 441
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443,
                3000
            ]
        },
        "carbon": {
            "bytes": 78086,
            "co2_grams": 0.0029,
            "cleaner_than": 27
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.201.68.31",
                    "host": "ns60.domaincontrol.com"
                },
                {
                    "ip": "97.74.100.31",
                    "host": "ns59.domaincontrol.com"
                }
            ],
            "zone": "0penware.com"
        },
        "location": {
            "ip": "5.183.78.22",
            "asn": "398779",
            "org": "Ace Host, LLC",
            "city": "Jacksonville",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "www.0penware.com"
        },
        "dns": {
            "A": [
                "5.183.78.22"
            ],
            "MX": [
                "{\"exchange\": \"0penware-com.mail.protection.outlook.com\", \"priority\": 0}"
            ],
            "NS": [
                "ns60.domaincontrol.com",
                "ns59.domaincontrol.com"
            ],
            "SOA": "{\"nsname\": \"ns59.domaincontrol.com\", \"hostmaster\": \"dns.jomax.net\", \"serial\": 2026082304, \"refresh\": 28800, \"retry\": 7200, \"expire\": 604800, \"minttl\": 600}",
            "TXT": [
                "NETORGFT21051981.onmicrosoft.com",
                "v=spf1 include:secureserver.net -all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "5.183.78.22",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://0penware.com",
                "https://www.0penware.com/"
            ],
            "count": 1
        },
        "linked_pages": {
            "internal_count": 11
        },
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "created": "2026-08-21T02:13:53Z",
            "updated": "2026-08-21T02:13:53Z",
            "expires": "2027-08-21T02:13:53Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientRenewProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns59.domaincontrol.com",
                "ns60.domaincontrol.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx/1.18.0 (Ubuntu)",
                "content-type": "text/html; charset=utf-8",
                "x-powered-by": "Next.js"
            }
        }
    }
}
```