playoathboundlegends[.]com

This domain is flagged as a high‑risk brand‑impersonation campaign targeting the Blast brand. The domain playoathboundlegends.com was registered on 18 December 2025 through Metaregistrar BV and resolves to 172.67.212.175, which belongs to AS13335 Cloudflare, Inc., United States. The authoritative nameservers aisha.ns.cloudflare.com and porter.ns.cloudflare.com indicate that the site is protected by Cloudflare and is serving HTTP/3 traffic. An HTTPS connection presents a certificate issued by Google Trust Services under the WE1 root, confirming a valid TLS chain but offering no indication of malicious intent. The HTTP response code is 525, meaning the origin server failed to respond, a pattern often observed in malicious proxy setups.

The page title returned by the server is “Oathbound Legends”, which does not reference the impersonated brand, and no further page content has been publicly disclosed. Threat intelligence sources corroborate the malicious nature: AlienVault OTX lists the domain in two separate pulses, and two independent blocklists – PhishDestroy and ScamSniffer – have already added it. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports five detections out of ninety‑five scanners, reinforcing the suspicion. The domain appears on two additional security blocklists, further confirming its reputation as an active threat.

Defenders should treat playoathboundlegends.com as hostile. Immediate mitigation steps include adding the domain to network and endpoint deny lists, enforcing DNS sink‑hole or firewall rules to block outbound connections, and ensuring that web filtering solutions flag any request to the domain. Continuous monitoring of the associated IP address and the Cloudflare edge nodes is advised, as the infrastructure may be reused for other campaigns.