opensea[.]com[.]sea-buyer[.]com

This domain, opensea.com.sea-buyer.com, is identified as a brand impersonation threat designed to mimic the legitimate OpenSea platform. Analysis indicates the site functions as a crypto wallet drainer, presenting a fraudulent "Connect wallet | OpenSea" page to deceive users into linking their cryptocurrency wallets. The infrastructure targets OpenSea users, a high-value demographic for wallet-draining attacks due to the platform's association with NFT and crypto asset transactions. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, and resolves to the IP address 134.199.231.252, hosted on AS14061 (DigitalOcean, LLC) in the United States. The domain lacks an SSL certificate, increasing its detectability as malicious. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The domain is not currently listed in Google Safe Browsing (GSB) at the time of analysis. The domain has been taken offline, likely due to detection and reporting by security entities. However, residual risk remains as threat actors may re-deploy similar infrastructure using newly registered domains or altered subdomains. Users are advised to verify domain authenticity before connecting wallets, enable multi-factor authentication on crypto platforms, and cross-reference URLs with official brand communications. Monitoring for newly registered lookalike domains remains critical for preemptive mitigation.