opensea-nft13-alpha[.]vercel[.]app

Analysis of opensea-nft13-alpha.vercel.app shows a high‑risk brand‑impersonation infrastructure targeting OpenSea users. The domain was registered on February 21, 2026 through Tucows Domains Inc. and resolves to IP address 64.29.17.131, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site presents a page titled "Deployment Unavailable" and returns HTTP status 451, indicating that the content is unavailable for legal reasons. The presence of Vercel hosting, HSTS enforcement, and a Google Trust Services / WR1 SSL certificate confirms a legitimate‑looking TLS layer, which can increase user trust.

However, the domain has been flagged by multiple external defenses: PhishDestroy and ScamSniffer have blocked it, and Google Safe Browsing classifies it as a social‑engineering threat. VirusTotal reports that 14 of 93 scanned security vendors flag the domain, reinforcing the suspicion of malicious activity. It also appears on two independent security blocklists. The listed scam type is a crypto scam, and the domain explicitly impersonates the OpenSea brand.

Current status is offline, suggesting the operators may be rotating infrastructure. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and correlate any traffic to the associated IP with other known malicious indicators. Further investigation is needed to determine whether the site ever served a phishing page or collected credentials, as the page content beyond the title is not publicly available. Until the infrastructure is definitively dismantled, the domain should be treated as a high‑confidence malicious actor targeting OpenSea users.