wanderlustverse[.]xyz

The domain wanderlustverse.xyz is flagged as a brand‑impersonation campaign targeting the blast brand. Infrastructure analysis reveals that the domain resolves to the IPv6 address 2a06:98c1:3120::3, which belongs to Cloudflare (AS13335) and is geolocated in the United States. No TLS certificate was observed, indicating the site does not serve HTTPS content. The domain is delegated to Cloudflare nameservers aiden.ns.cloudflare.com and sneh.ns.cloudflare.com, and the registrar is listed as PDR Ltd. d/b/a PublicDomainRegistry.com. Gridinsoft assigns a trust score of 0/100, confirming a high malicious rating.

The domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows that 11 of 95 scanning engines flagged the domain as malicious, providing independent confirmation of its threat nature. AlienVault OTX references the domain in three separate threat‑intel pulses, reinforcing its association with brand‑impersonation activity. The site’s page title was recorded as "Oathbound Legends," which does not directly reference the impersonated brand, and no additional page content has been disclosed. The domain was created on 18 December 2025 and is currently listed as offline as of the report date, 24 July 2026.

Known gaps include the absence of SSL/TLS details, lack of Safe Browsing status, and no publicly released phishing‑page payload or kit information, leaving the exact phishing vector unclear. Defenders should immediately block wanderlustverse.xyz and its IPv6 address at DNS resolvers and network firewalls, incorporate the domain, its registrar, and associated Cloudflare nameservers into URL‑filtering and threat‑intelligence feeds, and monitor for any re‑registration attempts or variant domains. Given the low trust score, multiple vendor detections, and OTX pulse presence, any email or web traffic involving this domain should be treated as malicious.