oathsaga[.]xyz

Analysis of oathsaga.xyz indicates a high-risk brand impersonation domain targeting the Blast cryptocurrency platform. The domain was registered on December 18, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and remains active as of July 24, 2026. It resolves to IP 188.114.96.3, hosted on Cloudflare's network (AS13335) in the US, with nameservers aiden.ns.cloudflare.com and sneh.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), and the site returns an HTTP 525 status, suggesting a potential SSL handshake failure or misconfiguration.

The page title 'Oathbound Legends' does not directly reference Blast, but the scam type is explicitly classified as brand impersonation targeting Blast. Detection data shows the domain appears on one security blocklist, and six of 95 security vendors on VirusTotal flag it as malicious. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. No evidence of widespread takedown or Safe Browsing flags is present in the available data, though PhishDestroy has blocked the domain.

Defenders should treat this domain as actively malicious. Recommended actions include blocking the domain and IP at perimeter defenses, monitoring for internal connections to 188.114.96.3, and reviewing logs for interactions with the page title 'Oathbound Legends' or references to Blast. The Cloudflare infrastructure and recent registration suggest the operator may rotate domains; defenders should correlate related indicators such as the SSL issuer, nameservers, or hosting provider for broader detection coverage. The exact content and functionality of the site remain unanalyzed, so further investigation may reveal additional phishing kits or payloads.