openseacim[.]vercel[.]app

On 23 July 2026, openseacim.vercel.app was observed as an offline site associated with a brand‑impersonation campaign targeting OpenSea. The domain was registered on 21 February 2026 through Tucows Domains Inc. and is hosted on the Vercel platform, as indicated by the presence of Vercel‑specific technology fingerprints and an HSTS header. DNS resolution points to IP address 216.198.79.131, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The TLS certificate presented by the server is issued by Google Trust Services under the WR1 label, confirming a valid HTTPS endpoint despite the site being unavailable. Network scans on VirusTotal recorded 15 positive detections out of 93 scanned security vendors, and the domain is listed on a single external blocklist.

PhishDestroy has also classified the domain as blocked. HTTP responses return status code 451, indicating that the resource is unavailable for legal reasons, and the page title returned is “Deployment Unavailable”. The campaign is categorized as a crypto scam, although no further details about the payload or victim interaction have been disclosed. At present the infrastructure appears to be taken offline, limiting immediate exposure.

However, the use of a reputable hosting provider, a valid SSL certificate, and the recent registration date suggest a rapid‑deployment model that could be reused with different subdomains. Defenders should continue to monitor the IP address 216.198.79.131 for new domains that share the same hosting environment, enforce blocklist entries for the domain, and apply URL filtering to prevent user access to any future incarnations. Additional threat‑intel feeds should be queried for related indicators such as similar domain naming patterns or identical TLS fingerprints. Until further evidence emerges, the confidence in the association with OpenSea remains high based on the explicit brand impersonation label in the intelligence.