opensea-nftboxx-sage[.]vercel[.]app

The domain opensea-nftboxx-sage.vercel.app has been identified as a high-risk brand impersonation threat specifically targeting the NFT marketplace OpenSea. This fraudulent site attempts to deceive users by mimicking OpenSea's login interface and branding, with the page title displaying "OpenSea.io" to further lend an air of legitimacy. Security analysis indicates this domain is part of a coordinated phishing campaign designed to steal user credentials and potentially drain cryptocurrency wallets.

Technical examination reveals that opensea-nftboxx-sage.vercel.app resolves to IP address 216.198.79.67 and was registered through Vercel Inc. on April 14, 2026. VirusTotal data shows 21 out of 95 security vendors flagging this domain as malicious, and it appears on 4 security blocklists. Although Google Safe Browsing status is not explicitly listed, the high blocklist presence and vendor flags strongly suggest active circulation in threat intelligence feeds.

As of the current analysis, the domain remains active and poses an ongoing risk to users who may encounter it via phishing emails, social media, or search results. PhishDestroy recommends immediate blocking of this domain at the DNS and email gateway levels. Users who have interacted with the site should change their OpenSea passwords, enable two-factor authentication, and monitor for unauthorized transactions. No drainer kit was explicitly identified, but the page title and impersonation pattern are consistent with credential theft tactics commonly used in NFT marketplace scams.