magicedens[.]run

The domain magicedens.run is currently active and hosts a page titled “Nur einen Moment…”. The site returns HTTP 403, is served through Cloudflare (AS13335) from a US‑based IP address 104.21.48.1, and uses a Google Trust Services / WE1 SSL certificate. Registration was performed via PDR Ltd. d/b/a PublicDomainRegistry.com; no specific nameserver data were disclosed. Gridinsoft assigns a trust score of 39 out of 100, indicating low reputation. VirusTotal analysis shows a single detection among 95 security vendors, and the domain appears on one external blocklist. PhishDestroy has already blocked the host. Technical fingerprints reveal Cloudflare’s edge services and HTTP/3 support. The infrastructure is explicitly linked to a brand‑impersonation campaign targeting Magic Eden, as indicated by the “Impersonates: Magic Eden” attribute. While the page content beyond the title has not been publicly examined, the combination of a low trust score, a single vendor flag, and active blocking suggests a malicious intent consistent with high‑risk brand spoofing. Defenders should add magicedens.run to deny‑list rules, monitor for similar Cloudflare‑proxied domains registered through the same registrar, and enforce strict URL filtering for any traffic attempting to resolve to the 104.21.48.1 address. Continuous observation of VirusTotal and blocklist updates is advised to capture any escalation in detection counts.