openseanftoffers[.]art

Analysis on July 23, 2026 identifies the domain openseanftoffers.art as an active infrastructure used to impersonate the OpenSea brand. The site was registered on July 7, 2025 via Go Daddy, LLC and resolves to the IPv4 address 148.163.121.30, which belongs to AS53755 Input Output Flood LLC located in the United States. The domain serves content over HTTPS using a Let’s Encrypt R13 certificate, and HTTP requests return a 200 status code. The page title reported by crawlers is “Open Sea Pro Metocean Forecast,” which does not reference the targeted brand but confirms the presence of a live web page.

Reputation services flag the domain: twelve of ninety‑five VirusTotal scanners raise detections, the domain appears on one external blocklist, it is listed as blocked by PhishDestroy, and AlienVault OTX includes it in fifteen threat‑intelligence pulses. The Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious use. The nameservers ns1.gomanilahost.net and ns2.gomanilahost.net are associated with the hosting provider. The observed activity aligns with a crypto‑scam classification.

While the exact phishing page layout and credential‑collection mechanisms are not publicly disclosed, the convergence of registrar, hosting, certificate, and multiple vendor detections demonstrates a high‑confidence malicious profile. Defenders should add openseanftoffers.art to URL filtering and blocklists, monitor DNS queries for the associated nameservers, and consider isolating traffic to the resolved IP address. Continuous re‑scanning of the domain on VirusTotal and inclusion in threat‑intel feeds is recommended to capture any evolution of the infrastructure.