open-agent-phi[.]vercel[.]app

Analysis conducted on July 19, 2026 identifies the domain open-agent-phi.vercel.app as an active brand‑impersonation infrastructure targeting OpenSea users. The site returns an HTTP 307 redirect and presents the page title “OpenSea | Agents”, indicating a deliberate attempt to suggest official OpenSea content. Hosting is provided by Vercel, Inc., with the domain resolving to IP address 64.29.17.195 located in the United States. The TLS certificate is issued by Google Trust Services under the WR1 certificate authority, confirming a valid HTTPS connection. The infrastructure has been observed on three independent security blocklists and is currently blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that 16 of 91 security engines flag the domain as malicious, reinforcing the suspicion of malicious intent. While the exact payload or credential‑harvesting mechanism has not been publicly disclosed, the combination of brand impersonation, redirection behavior, and multiple vendor detections suggests a high‑risk phishing campaign. Defenders should incorporate the domain and its IP address into deny‑list rules, monitor for related DNS queries, and advise users to verify URLs before interacting with any OpenSea‑related services. Ongoing observation is recommended to detect any changes in hosting or content.