opensea-login[.]square[.]site

This domain, opensea-login.square.site, is identified as a brand impersonation phishing resource specifically targeting OpenSea, the largest NFT marketplace. The domain is currently offline but was previously active in credential harvesting campaigns. Analysis of its infrastructure and detection metrics provides critical indicators for threat mitigation. Infrastructure analysis reveals the domain was created on February 05, 2019, and registered through MarkMonitor, Inc. It resolves to the IP address 74.115.51.5 and uses a Let's Encrypt SSL certificate. Detection metrics indicate the domain was flagged by 2 of 95 security vendors on VirusTotal and appears on one security blocklist. The page title, 'Home | OpenSea, the largest NFT marketplace | Opensea Login,' closely mimics legitimate OpenSea branding, increasing the likelihood of successful phishing attempts. Technologies detected include Amazon Web Services and Cloudflare, suggesting the use of commercial hosting and CDN services to evade detection. Current status confirms the domain has been taken offline, likely due to enforcement actions or takedown requests. However, the risk remains elevated for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access to OpenSea accounts, reset credentials if exposure is suspected, and implement multi-factor authentication to mitigate credential theft risks. Network administrators should block the domain and associated IP address (74.115.51.5) at the perimeter to prevent potential re-emergence or related malicious activity. Continuous monitoring of newly registered domains mimicking OpenSea branding is recommended to detect and disrupt similar threats.