opensea[.]com[.]of-awaiting[.]com

Analysis of opensea.com.of-awaiting.com shows a high‑risk brand‑impersonation campaign targeting OpenSea users. The domain was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on a DigitalOcean server (AS14061) located in the United States, resolving to IP 134.199.231.252. Infrastructure fingerprints reveal the presence of Plesk and Nginx web servers, while the site lacks an SSL certificate, indicating an unencrypted HTTP endpoint. The page title returned by the live host before takedown was "Connect wallet | OpenSea," aligning with the declared crypto‑scam classification.

The domain appears on four independent blocklists, specifically PhishDestroy, MetaMask, ScamSniffer, and SEAL, all of which have marked it as malicious and have contributed to its current offline status. VirusTotal scans report 14 detections out of 95 security vendors, reinforcing the malicious verdict. Nameservers point to the njalla network (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a common choice for fast‑flux or evasive actors.

While the exact phishing page content has not been captured, the combination of brand impersonation, wallet‑connection phrasing, and the absence of TLS suggests an attempt to lure victims into authorising cryptocurrency transactions. Defenders should add the domain, its IP address, and associated nameservers to outbound filtering rules, monitor for any residual traffic to the IP, and update internal threat intel feeds with the observed indicators. Continuous monitoring of blocklist updates and re‑scanning of the IP range is advised, as the infrastructure may be reused for further impersonation campaigns.