opensee-app[.]carrd[.]co

Analysis of opensee-app.carrd.co, observed on 23 July 2026, indicates an active brand‑impersonation infrastructure targeting OpenSea users. The domain resolves to 104.18.40.34, a Cloudflare edge address (AS13335, United States). Registration is listed through Cloudflare, Inc., and the site is protected by a Google Trust Services (WE1) TLS certificate, suggesting the use of Cloudflare’s free hosting and SSL services. HTTP responses return a 403 status code, which may be used to obscure content from automated scanners while still delivering malicious pages to targeted victims. The page title returned by the server is “OpenSea Login | Securely Connect Your Web3 Wallet to Access NFTs”, directly referencing the OpenSea brand and the typical phrasing used in crypto‑wallet authentication flows, confirming the claim of a crypto scam.

Security‑vendor scans on VirusTotal show 12 of 95 scanners flagging the domain, reinforcing the malicious classification. The domain appears on a single public blocklist and is specifically listed by PhishDestroy as a blocked site. No additional nameserver information is available; the nameserver query returned “NS_NOT_FOUND”, indicating that standard DNS enumeration did not reveal authoritative servers, which is consistent with Cloudflare’s proxy‑only deployment. Uncertainty remains regarding the exact payload delivered to victims, as the current HTTP 403 response prevents direct observation of the landing page content.

Neither Safe Browsing nor Open Threat Exchange entries are referenced in the available intelligence, so broader ecosystem visibility is limited. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to the IP 104.18.40.34, and update email and web‑gateway filters to flag the page title string. Organizations that manage OpenSea‑related credentials should remind users that OpenSea does not host login pages on carrd.