exclusive0penseamints07[.]vercel[.]app

exclusive0penseamints07.vercel.app was observed hosting a fraudulent site that claims to represent OpenSea, as indicated by the page title “OpenSea.io”. The domain was registered through Vercel Inc. on 17 March 2026 and is hosted on the Vercel platform, which also delivers HTTP Strict Transport Security (HSTS) headers. The site returned HTTP status code 451, indicating that the content is unavailable, and the domain is currently taken offline. DNS resolution points to IP address 64.29.17.3, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WR1 profile, confirming the use of a valid HTTPS certificate despite the malicious intent.

Multiple security‑vendor blocklists have already flagged the domain. PhishDestroy, MetaMask, ScamSniffer, and SEAL list it as malicious, and the domain appears on four additional blocklists. The Gridinsoft trust score is 0 out of 100, reinforcing the classification as a high‑risk threat. VirusTotal scans show that 13 of 94 security engines detected malicious behavior, further corroborating the phishing nature. The identified scam type is a crypto scam, consistent with the OpenSea impersonation.

Because the domain is currently offline, direct interaction is limited, but the infrastructure details remain useful for attribution and defensive measures. Defenders should update their URL filtering and DNS sinkhole rules to block 64.29.17.3 and any future subdomains under the same Vercel account. Email gateways should be configured to flag messages containing the domain or references to “OpenSea.io”. Continuous monitoring of Vercel‑hosted assets for similar patterns is recommended, as the platform is frequently abused for rapid deployment of fraudulent sites. Analysts should also watch for new registrations that reuse the “exclusive0penseamints07” naming pattern, as the seed c9bdb0 suggests a systematic campaign.