# PhishDestroy domain threat record: opensea.legal Content language: English Canonical HTML report: https://phishdestroy.io/domain/opensea.legal/ Machine-readable companion: https://phishdestroy.io/domain/opensea.legal/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-22 13:05:23 UTC - Stored record updated: 2026-10-22 16:30:28 UTC - VirusTotal detections in the stored snapshot: 6/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: OpenSea ## Stored infrastructure - Observed IP address: 2.26.96.13 - Registrar in stored WHOIS data: Global Domain Group LLC - Last stored HTTP status: 200 - Registration date (registry RDAP, opensea.legal): 2026-09-21 17:03:21 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0fe7c-9d1b-70bb-9578-fc262d4d06e7/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/opensea.legal - Certificate Transparency search: https://crt.sh/?q=%25.opensea.legal - Web Archive lookup: https://web.archive.org/web/*/https://opensea.legal/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed opensea.legal on 2026-10-22 after an intake that highlighted three malicious and three suspicious detections on VirusTotal. The page presents the title "OpenSea" and returned HTTP 200 on the same date. The domain was registered on 2026-09-21 with Global Domain Group LLC. No evidence of credential capture or wallet interaction was observed on the captured page. How the scam works Domains that mimic well‑known brands are often used to lure users into revealing login credentials, approving wallet transactions, or providing personal information. The current evidence does not confirm any of these actions on opensea.legal; the listing reflects a general risk associated with brand‑impersonation attempts rather than a verified technique. Evidence VirusTotal (analysis 2026-10-16) reported six detections: three malicious (ChainPatrol, Ermes, Forcepoint ThreatSeeker) and three suspicious (alphaMountain.ai, Fortinet, Gridinsoft). Google Safe Browsing checked on 2026-10-22 reported no flag. The external SEAL blocklist included the domain (checked 2026-10-22). PhishDestroy internal blocklist also marks it as true (checked 2026-10-22). OTX showed zero pulses (checked 2026-10-22). urlscan.io captured the site on 2026-10-02; its engine verdict scored 76 and marked it malicious, while the overall verdict was non‑malicious. Infrastructure The recorded DNS A record pointed to 2.26.96.13, which was associated with Play2go International Limited in the Netherlands and served through Cloudflare. Registration occurred on 2026-09-21 via Global Domain Group LLC, with a transfer‑prohibited status. TLS uses a Let’s Encrypt certificate valid until 2027-01-03. Open ports observed were 22, 80, and 443. What to do Do not enter any OpenSea credentials or approve wallet actions on this site. If credentials were submitted, change passwords and enable two‑factor authentication on the affected accounts. Monitor associated accounts for unauthorized activity and report the domain to PhishDestroy. Security teams should add a block rule for opensea.legal in web filters and review logs for any connections to the recorded IP address. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0fe7c-9d1b-70bb-9578-fc262d4d06e7/ Cloudflare Radar report: https://radar.cloudflare.com/scan/01d9bc8e-77ae-455b-b887-d640d08699a5 Stored capture screenshot: https://urlscan.io/screenshots/01a0fe7c-9d1b-70bb-9578-fc262d4d06e7.png Cloudflare Radar screenshot (2026-10-22T13:10:11Z): https://screenshots.phishdestroy.io/cf/01d9bc8e-77ae-455b-b887-d640d08699a5.png URLScan screenshot (2026-10-22T13:11:33Z): https://screenshots.phishdestroy.io/us/01a163bc-b5fa-711a-a8a0-0f64e3a4d0e0.png URLScan capture report: https://urlscan.io/result/01a163bc-b5fa-711a-a8a0-0f64e3a4d0e0/ VirusTotal report: https://www.virustotal.com/gui/domain/opensea.legal Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=opensea.legal Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 13:18:11 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0fe7c-9d1b-70bb-9578-fc262d4d06e7.png Captured: 2026-10-22 13:05:23 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0fe7c-9d1b-70bb-9578-fc262d4d06e7.png Source report: https://urlscan.io/result/01a0fe7c-9d1b-70bb-9578-fc262d4d06e7/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/01d9bc8e-77ae-455b-b887-d640d08699a5.png Captured: 2026-10-22 13:10:11 UTC Source report: https://radar.cloudflare.com/scan/01d9bc8e-77ae-455b-b887-d640d08699a5 SHA-256: 9aedbc491af4e6fc79612ca10857812f71bfb225c2a8f3433ff1d3aabe4a66d2 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163bc-b5fa-711a-a8a0-0f64e3a4d0e0.png Captured: 2026-10-22 13:11:33 UTC Source report: https://urlscan.io/result/01a163bc-b5fa-711a-a8a0-0f64e3a4d0e0/ SHA-256: 458a6b9a85da9889ba7b16653d622bca37b0960647f807295c2919c67c2a0e1d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T13:17:24Z", "uuid": "01a0fe7c-9d1b-70bb-9578-fc262d4d06e7", "scanned_at": "2026-10-02T21:19:46Z", "final_url": "https://opensea.legal/", "status": 200, "ip": "2a06:98c1:3120::3", "domains": [ "i2c.seadn.io", "raw2.seadn.io", "www.gstatic.com", "www.recaptcha.net", "fonts.gstatic.com" ], "ips": [ "2a00:1450:4001:c1f::5e", "2a00:1450:4001:c0f::5e", "2600:9000:28eb:2600:12:7503:8f00:93a1", "2600:9000:28dc:a600:e:a9ee:e140:93a1", "2a00:1450:4001:c15::5e", "2a06:98c1:3120::3" ], "asns": [ "15169", "16509", "13335" ], "countries": [ "DE", "US" ], "doc_hash": "606f29cd2b5bd1d9c0bda1beeccffe0ad0cb4f80b41319b09443d605d23919cf", "script_hashes": [ "60599729f3f303d79b01a21e9275dd0630b31607e8b8779c6468017d61cc6b63", "a90f531b938ce6f832f53d936b6a4b2309373a8e7282d91827df6cc6a81ff458", "410a499b83a20bbe2a26455d4e93691f3466fbdeb248f25f45be956c9b0a7d14", "a9f14808815ab97459b148e9689864c3f09badf0637132b0d4c18a57aff1c8a9", "4bb57079f13315bcc6f57c49443da86152f2f2c0045e259b50a0f48ec1e2b42a", "2be331e485298b86b26d893303c35092e286800ad8a1f08165a50a3d704fe66f", "8d1909ef66a347e3038e13879ae96388493b2914be16de821d6ed5def299b814", "03fc4e0001f6d74f8303605260f052b0de0b513d3600787e4fe2eed4087d7b2e", "0c1e25105c6c9833609f3efa4e9a1926f067dfe654fe686a48a000bb67e45a43", "259975b5d0d6ca7748e000b21abec18933c708931b8c997ae9abcdf6cf26d19f" ], "globals": [ "TURBOPACK", "$RB", "$RV", "$RC", "__next_f", "$RT", "next", "__webpack_hash__", "_N_E_STYLE_LOAD", "onRecaptchaLoadCallback", "___grecaptcha_cfg", "grecaptcha", "__recaptcha_api", "__google_recaptcha_client", "recaptcha", "closure_lm_336990", "scrypt" ], "cookies": [ "__Host-authjs.csrf-token", "__Secure-authjs.callback-url" ], "storage_keys": [ "i18next.translate.boo", "locale" ], "tls": { "san": [ "*.opensea.legal", "opensea.legal" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "opensea.legal", "protocol": "QUIC", "valid_to": "2026-12-31T16:23:07Z", "valid_from": "2026-10-02T16:23:08Z" }, "domain_age_days": 1415, "apex_age_days": 1415, "tls_age_days": 0, "tls_valid_days": 89, "requests": 173, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 76, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-powered-by": "Next.js" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T13:16:03Z", "uuid": "01d9bc8e-77ae-455b-b887-d640d08699a5", "scanned_at": "2026-10-22T13:10:11Z", "final_url": "https://opensea.legal/", "status": 200, "history": [ { "url": "https://opensea.legal/", "status": 200 } ], "dom_hash": "8a77c50c4d7324bd345f3e788c25afd06f7503b83080ab0d3e4a828ce7506749", "doc_hash": "e4cd8c251c01100d8b5a6c3b441f7e6f022529af0ab9fc25d625a2ed1679b000", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "opensea.legal", "type": "A", "value": "2.26.96.13" } ], "dnssec_valid": false, "ip": "2.26.96.13" }, "vt": { "v": 1, "fetched_at": "2026-10-22T13:09:39Z", "analysis_at": "2026-10-16T13:57:17Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 3, "suspicious": 3, "undetected": 33 }, "detections": { "Ermes": "phishing", "Fortinet": "spam", "Gridinsoft": "suspicious", "ChainPatrol": "malicious", "alphaMountain.ai": "spam", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2021-09-22T00:00:00Z", "updated": "2022-09-20T00:00:00Z", "first_seen": "2024-10-16T05:17:29Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "davina.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "davina.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "dion.ns.cloudflare.com" }, { "ttl": 60, "type": "A", "value": "2.26.96.13" } ], "dns_at": "2026-10-16T13:57:35Z", "jarm": "2ad2ad0002ad2ad00042d42d000000301510f56407964db9434a9bb0d4ee4a", "cert": { "san": [ "opensea.legal", "www.opensea.legal" ], "issuer": "Let's Encrypt / YR1", "serial": "51c270bb218680f06d69b5f2ead34d65698", "sha256": "ab24053bf7acb175e4b26a378191a8fc6cc0c1d8e0c3f6c462f694a671566f78", "subject": "opensea.legal", "valid_to": "2027-01-03T15:09:46Z", "valid_from": "2026-10-05T15:09:47Z" }, "whois": [], "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-21T17:03:21Z", "last changed": "2026-10-05T15:46:44Z", "registration": "2026-09-21T17:03:21Z", "registrar expiration": "2027-09-21T17:03:21Z", "last update of RDAP database": "2026-10-15T08:23:17Z" }, "registrar": "Global Domain Group LLC", "registrar_iana_id": "3956" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T13:17:47Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "opensea.legal" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-22T13:10:02Z", "first": "2021-12-20T02:56:12Z", "changes": 3, "days_archived": 4, "scans_per_day": 0, "avg_page_bytes": 7396 }, "social_tags": { "ogTitle": "OpenSea", "ogSiteName": "OpenSea", "description": "Buy, sell, and discover NFTs on OpenSea — collections, trading, and market analytics.", "twitterCard": "summary", "ogDescription": "Buy, sell, and discover NFTs on OpenSea — collections, trading, and market analytics." }, "trackers": { "requests": 27 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 27, "wait": 688, "connect": 33, "download": 733 }, "response_ms": 1483 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443 ] }, "carbon": { "bytes": 345206, "co2_grams": 0.0126, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "108.162.193.156", "host": "dion.ns.cloudflare.com" }, { "ip": "172.64.34.40", "host": "davina.ns.cloudflare.com" } ], "zone": "opensea.legal" }, "location": { "ip": "2.26.96.13", "asn": "215439", "org": "Play2go International Limited", "city": "Amsterdam", "country": "NL" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "opensea.legal" }, "dns": { "A": [ "2.26.96.13" ], "NS": [ "davina.ns.cloudflare.com", "dion.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"davina.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417570379, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2.26.96.13", "family": 4 }, "redirects": { "chain": [ "https://opensea.legal" ] }, "subdomains": { "count": 1, "subdomains": [ "www.opensea.legal" ] }, "tech_stack": { "technologies": [ "Node.js", "Ubuntu", "React", "Nginx", "Next.js", "reCAPTCHA", "Priority Hints", "Webpack", "Open Graph" ] }, "linked_pages": { "internal_count": 9 }, "headers": { "headers": { "server": "nginx/1.18.0 (Ubuntu)", "content-type": "text/html; charset=utf-8", "x-powered-by": "Next.js", "x-content-type-options": "nosniff" } } } } ```