openseeio[.]framer[.]ai

openseeio.framer.ai was observed hosting a page titled "OpenSea Login™ — Connect Your Wallet & Access NFTs". The site resolves to the Amazon Web Services address 52.223.52.2, which belongs to AS16509 (Amazon.com, Inc.) and is located in the United States. The TLS certificate is issued by Let’s Encrypt (E8) and the server presents HSTS and HTTP/3, indicating a modern web stack. Technical fingerprints show the use of Framer Sites and React, consistent with the hosting provider's template services. The domain was registered on April 04 2023 through CSC Corporate Domains, Inc. and is delegated to four AWS name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns).

It has been listed on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis recorded a single positive detection out of ninety-three scanned vendors, reinforcing the suspicion of malicious intent. The page title explicitly references OpenSea, and the campaign is classified as a crypto-related brand impersonation. The HTTP response currently returns 404, and the site is marked offline as of the report date, July 24 2026.

While the offline status limits immediate exploitation, the infrastructure components—AWS hosting, a valid Let’s Encrypt certificate, and the use of legitimate web technologies—demonstrate a common tactic of leveraging trusted services to increase credibility. Defenders should continue to monitor the associated IP address and the registrar for any re-use of the infrastructure. Blocking the domain and its IP at network perimeters, updating URL filtering lists, and flagging any future DNS resolutions to the same name servers are recommended. Organizations that allow OpenSea wallet connections should educate users about the verified OpenSea login URL and encourage verification of TLS certificates and domain spelling to mitigate credential harvesting attempts.