opensearewards[.]run

The domain opensearewards.run was observed targeting the OpenSea brand through a crypto‑scam impersonation. Registration data indicate the domain was created via Cloudflare, Inc., and the authoritative nameservers are gwen.ns.cloudflare.com and ned.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. No TLS certificate is presented for the host, meaning the site is served only over HTTP.

The only visible page title returned before the site was taken offline reads “Nur einen Moment…”, providing no further context about the malicious landing page. Threat intelligence sources have flagged the domain: PhishDestroy lists it as blocked, it appears on one external security blocklist, and AlienVault OTX includes it in a single pulse. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious activity. VirusTotal analysis shows that ten of ninety‑five scanning engines flagged the domain as malicious, reinforcing the suspicion.

The combination of brand impersonation, a crypto‑scam classification, lack of encryption, and multiple independent detections suggests a high‑confidence malicious indicator. Because the site is currently offline, live content cannot be verified, but the existing artifacts are sufficient for defensive action. Organizations should add opensearewards.run to DNS and URL filtering policies, block the associated IP address 188.114.96.3, and monitor for any future re‑registration or similar Cloudflare‑hosted domains that reference OpenSea. Continuous threat‑intel feeds should be consulted for updates, and any internal traffic to the domain should be logged and investigated.