heavense[.]run

Analysis as of July 22, 2026 indicates that the domain heavense.run was registered on February 21, 2026 and is presently taken offline. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 owned by Cloudflare, Inc., placing the hosting infrastructure within the United States. HTTP requests to the site return a 404 Not Found page title, and the SSL certificate presented is identified as WE1. Reputation services provide a consistent negative signal: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on a single security blocklist and is explicitly blocked by PhishDestroy.

VirusTotal reports that one out of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious use. The only classified activity is a brand‑impersonation phishing campaign, although the specific victim brand is not disclosed in the available data. The limited detection footprint suggests that the infrastructure was short‑lived or has already been dismantled, which aligns with the current offline status. Uncertainty remains regarding the exact phishing kit, any associated command‑and‑control servers, and whether additional domains share the same hosting footprint.

Defenders should continue to monitor the IP address 188.114.96.3 for any re‑use, ensure that outbound traffic to this address is blocked, and add heavense.run to internal blocklists. Analysts are advised to query passive DNS and certificate transparency logs for historic resolutions that may reveal related domains or future redeployments. Ongoing vigilance is recommended given the recent creation date and the observed blocklist entries.