opensea-nftbox-pi[.]vercel[.]app

Analysis of opensea-nftbox-pi.vercel.app, created on February 21, 2026 and registered through Tucows Domains Inc., shows a high‑risk brand‑impersonation profile targeting OpenSea. The site resolves to IP address 216.198.79.131, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. An SSL certificate issued by Google Trust Services (WR1) is present, and the infrastructure reports Vercel hosting with HTTP Strict Transport Security enabled. The HTTP response code returned is 451, and the page title displayed is "Deployment Unavailable," indicating that the service is currently taken offline.

VirusTotal scans have recorded 15 detections out of 93 security vendors, confirming that multiple scanners flag the domain as malicious. The domain appears on four known security blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. The intelligence categorizes the activity as a crypto‑scam, consistent with the brand‑impersonation motive.

While the exact content of the site cannot be verified because the deployment is unavailable, the combination of a recent registration date, a reputable SSL issuer used for a malicious purpose, the presence on multiple blocklists, and the detection count collectively substantiate a high‑confidence assessment of malicious intent. Defenders should continue to block the domain at network perimeters, monitor for any re‑deployment, and update threat‑intel feeds with the observed indicators. Organizations using OpenSea should educate users about the risk of unsolicited links referencing this domain and enforce strict URL verification policies.