openedenfoundation[.]xyz

The domain openedenfoundation.xyz was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on 30 September 2025. It resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative name servers listed are jakub.ns.cloudflare.com, ns1.suspended-domain.com, ns2.suspended-domain.com and zainab. No TLS certificate is presented; the site served only HTTP, and as of the report date the host is taken offline, preventing live content retrieval. The only visible page element is the title “Nur einen Moment…”, which does not disclose the intended victim brand.

Intelligence indicates the site employed an “Airdrop Scam” phishing kit targeting NFT investors. The domain appears on two security blocklists and is specifically blocked by PhishDestroy and ScamSniffer. VirusTotal analysis recorded six positive detections out of ninety‑five scanners, and Gridinsoft assigned a trust score of 0 / 100. AlienVault OTX listed the domain in a single threat‑intelligence pulse.

Evidence points to an elevated risk level despite the current offline state. Defenders should continue to block the domain at DNS and network layers, monitor the associated IP 188.114.97.3 for any re‑activation, and add the observed name servers to watchlists for potential reuse. Because the site has no SSL and no current HTTP response, any future re‑hosting would be detectable through the same infrastructure fingerprints. Continuous threat‑intel feeds should be consulted for updates to blocklist status and additional detections.