live-openseamints39[.]vercel[.]app

This domain, live-openseamints39.vercel.app, is flagged for brand impersonation targeting OpenSea, a leading non-fungible token (NFT) marketplace. Analysis indicates the infrastructure was designed to mimic OpenSea’s official web presence, likely to deceive users into disclosing credentials or authorizing fraudulent transactions. The page title "Deployment Unavailable" suggests the phishing kit may have been temporarily disabled or misconfigured at the time of detection, though prior activity remains unverified. No direct evidence of a crypto drainer kit was observed, but the domain’s structure aligns with known impersonation tactics used in NFT-related scams. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc., and resolved to the IP address 64.29.17.67, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain is flagged by Google Safe Browsing as phishing and appears on five security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. VirusTotal reports 17 out of 95 security vendors detecting the domain as malicious, with the SSL certificate issued by Google Trust Services (WR1). These indicators confirm the domain’s association with phishing activity, despite its current inactive state. The domain has been taken offline, likely due to enforcement actions by hosting providers or registrars. However, residual risk persists, as threat actors may re-deploy the infrastructure under a new domain or hosting provider. Users who interacted with the domain prior to its takedown should revoke any connected wallet authorizations, reset credentials, and monitor accounts for unauthorized transactions. Organizations are advised to block the domain and associated IP address in network security controls to prevent future access attempts. Continuous monitoring of similar impersonation patterns targeting NFT platforms is recommended.