marketing[.]api-listing-opensea[.]com

The domain marketing.api-listing-opensea.com was registered on September 10 2024 through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to the Amazon‑owned address 15.197.130.221 located in the United States under ASN 16509. No TLS certificate is presented, indicating the site was served over plain HTTP when it was active. The page title returned by the server is “api‑listing‑opensea.com”, matching the brand target OpenSea and confirming the intent to impersonate the NFT marketplace. VirusTotal records show that 14 of 95 scanned security vendors flagged the domain as malicious, and Google Safe Browsing classifies it as a social‑engineering threat.

The domain appears on one external blocklist and is listed as blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The infrastructure uses three registrar‑owned nameservers (ina1‑ina3.registrar.eu) together with two OpenProvider name servers (ns1.openprovider.nl, ns2.op), a configuration often observed in short‑lived phishing campaigns. The site is currently offline, and no SSL certificate or further content has been captured.

Because the domain explicitly references OpenSea in its title and targets cryptocurrency transactions, it is categorized as a crypto‑scam brand‑impersonation campaign. Defenders should continue to block the resolved IP address and associated name servers, update detection rules to flag any future resolution of this domain, and monitor for similar sub‑domains that reuse the “api‑listing‑opensea.com” pattern. Incident response teams should also advise users of OpenSea to disregard unsolicited communications referencing “api‑listing‑opensea.com” and to verify URLs before entering wallet credentials. Further analysis is limited by the offline status of the host, so additional payload or phishing page details remain unknown.