live-openseasmint24[.]vercel[.]app

The domain live-openseasmint24.vercel.app was observed on 23 July 2026 and is currently offline. It was registered on 21 February 2026 through Tucows Domains Inc. and resolves to the IP address 216.198.79.131, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The TLS certificate is issued by Google Trust Services under the WR1 root, indicating a valid certificate chain but offering no assurance of legitimacy. HTTP requests return status code 451, and the only visible page title is “Deployment Unavailable,” which provides no functional content for analysis. VirusTotal records indicate that 15 of 93 scanned security vendors flagged the domain, reflecting a moderate to high level of malicious classification.

Independent blocklist aggregators have added the domain to four known security blocklists, and it is explicitly listed as blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. Automated fingerprinting identified the hosting platform as Vercel and the presence of HTTP Strict Transport Security (HSTS), both typical of legitimate deployments but also frequently leveraged by abuse actors. The domain is associated with a brand‑impersonation campaign targeting OpenSea, and the scam type is identified as a crypto scam. No additional content or credential‑capture pages were captured before the takedown, so the exact phishing vector remains uncertain.

However, the combination of a recent registration date, rapid deployment on a cloud platform, a valid SSL certificate, and multiple vendor detections aligns with known patterns of fast‑flux cryptocurrency‑draining operations. Defenders should continue to block the hostname and its resolved IP at perimeter and DNS filtering layers, monitor for any resurgence of the sub‑domain pattern, and update threat‑intel feeds with the observed identifiers. Given the active blocklist entries and vendor detections, inclusion of the domain in corporate web‑filtering policies is warranted.