openionft[.]xyz

The domain openionft.xyz presents a clear brand impersonation threat, specifically targeting users of the OpenSea NFT marketplace. This domain is designed as a crypto drainer, meaning it attempts to trick visitors into connecting their cryptocurrency wallets or entering sensitive information, which can then be used to steal digital assets. The page title, "Loading... Wait...", is a common tactic used by malicious sites to keep users engaged while malicious scripts execute in the background, potentially draining wallets or harvesting credentials.

Evidence gathered by PhishDestroy confirms the malicious nature of this domain. VirusTotal reports indicate that 3 out of 95 security vendors flag this domain as malicious, and it also appears on 2 separate security blocklists. The domain was created on October 23, 2025, and registered through HOSTINGER operations, UAB, a registrar frequently associated with low-quality or fraudulent domains. It resolves to the IP address 198.251.81.14 and lacks an SSL certificate, which further undermines its legitimacy. The domain is currently offline, but its infrastructure remains a risk if reactivated.

For users who may have visited openionft.xyz, immediate action is recommended. If any credentials were entered, they should be changed on the legitimate OpenSea platform immediately. Additionally, users should review their cryptocurrency wallet activity and revoke any permissions granted to unknown sites. Run a full security scan on the device used to access the domain, and monitor accounts for unusual activity. PhishDestroy advises treating any unsolicited links or sites claiming to be OpenSea with extreme caution, and always verifying URLs directly through official channels.