opensea[.]nft-io[.]com

Analysis of opensea.nft-io.com shows a domain created on 17 December 2025 and currently taken offline. The domain is registered through Tucows Domains Inc. and resolves to the IP address 45.55.65.178, which belongs to the DigitalOcean, LLC network (AS14061) located in the United States. No TLS certificate is present, indicating that the site was served over plain HTTP when it was reachable. The HTTP response returned the default Plesk Obsidian 18.0.74 page title, a generic control‑panel landing page rather than any OpenSea‑related content. The domain is listed as impersonating the OpenSea brand and is classified as a crypto‑scam.

Reputation services provide a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist. VirusTotal reports that 19 of 95 scanned security vendors flagged the site, suggesting malicious characteristics despite the relatively low number of detections. PhishDestroy has already blocked the domain, and the same blocklist entry is reflected in the observed blocklist count. Nameserver delegation uses three Njalla servers (1‑you.njalla.no, 2‑can.njalla.in, 3‑get.njalla.fo), a pattern often associated with disposable or privacy‑focused hosting.

The combination of recent registration, lack of encryption, low trust score, detection by multiple vendors, and explicit brand impersonation indicates a high likelihood that the domain was used for credential harvesting or fraudulent crypto transactions targeting OpenSea users. Defenders should continue to block the domain at network perimeters, update threat‑intelligence feeds with the observed indicators, and monitor the associated IP address for any reactivation. Additional verification of any future DNS resolution to the same IP or Njalla nameservers should trigger immediate containment, as the infrastructure suggests a rapid redeployment capability.