open-sea[.]app

This domain, open-sea.app, was identified as a crypto scam impersonating OpenSea, a well-known NFT marketplace. Registered on February 21, 2026, the domain resolved to IP address 63.176.8.218, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'Орена - NFT Marketplace,' employed Unicode obfuscation to evade basic detection mechanisms, a common tactic in phishing campaigns targeting cryptocurrency users.

Analysis indicates the domain was taken offline by the time of this report, though it remains listed on three security blocklists. Detection vendors PhishDestroy, ScamSniffer, and SEAL have flagged the domain, while VirusTotal records show 5 of 93 security vendors marking it as malicious. The absence of an SSL certificate and the use of nameservers (dns1.p09.nsone.net through dns4.p09.nsone.net) suggest a low-effort but potentially effective phishing setup. Defenders should treat this domain as part of a broader pattern of OpenSea impersonation, particularly given the crypto scam classification.

While the domain is currently offline, its infrastructure (hosting provider, nameservers) may be reused in future campaigns. Organizations should monitor for related domains leveraging similar naming conventions or hosting patterns. If historical traffic logs exist, review connections to 63.176.8.218 for potential compromise indicators. No further details about the exact scam mechanics (e.g., wallet drainer, fake token sales) are available from the provided data.