oathboundfrontier[.]com

On July 24, 2026 the domain oathboundfrontier.com was identified as a high‑risk brand‑impersonation campaign targeting the Blast brand. The domain was registered on December 18, 2025 through Metaregistrar BV and resolves to the Cloudflare‑owned address 172.67.219.46 (AS13335, United States). Both authoritative nameservers, becky.ns.cloudflare.com and thomas.ns.cloudflare.com, are hosted by Cloudflare, which also provides the observed HTTP/3 support and the SSL certificate issued by Google Trust Services (WE1). An HTTP 525 status code indicates that the origin server failed to establish a TLS handshake, suggesting a misconfiguration or intentional disruption of the back‑end service. Gridinsoft assigns a trust score of 0 / 100, reflecting a lack of credibility.

Detection telemetry shows the domain is listed on two security blocklists and has been actively blocked by the PhishDestroy and ScamSniffer filtering platforms. AlienVault OTX references the domain in a single threat‑intelligence pulse, and VirusTotal reports that 2 of 95 scanned security vendors flagged the site, reinforcing the suspicion of malicious activity. The page title returned from the HTTP response is “Oathbound Legends,” which does not appear to be related to the advertised Blast brand, indicating possible credential‑harvesting or diversion tactics. While the available data confirm the infrastructure, hosting, and detection posture, the exact content served at oathboundfrontier.com has not been publicly disclosed; no screenshots, form fields, or credential‑capture mechanisms have been captured.

Consequently, the specific phishing kit or payload remains unknown. Defenders should prioritize immediate containment by adding the domain to corporate DNS block lists, updating web‑gateway signatures to include the observed nameservers and IP address, and monitoring for any outbound connections to the Cloudflare‑hosted IP.