openseas[.]jp

The domain openseas.jp was registered on February 21, 2026 and resolves to the IPv4 address 183.181.86.73, which belongs to AS131965 Xserver Inc. in Japan. The site presents a page titled “Open Seas”, deliberately mimicking the legitimate OpenSea brand. The domain is currently active, serving HTTP 200 responses, and is hosted behind Cloudflare with an Nginx front‑end. Infrastructure analysis shows the site runs a typical WordPress stack: WordPress, MySQL, PHP, Bootstrap, Typekit, Lightbox, and Nginx. A Let’s Encrypt certificate (R12) secures the HTTPS connection, which may lend false credibility. The domain’s authoritative name servers are ns1‑ns5.xserver.jp, confirming the use of Xserver’s DNS service. Threat intelligence sources flag openseas.jp as a high‑risk brand‑impersonation campaign. It appears on one security blocklist and is listed as blocked by PhishDestroy. VirusTotal reports three of ninety‑five scanners flagging the domain, and AlienVault OTX contains six pulses referencing it. The Gridinsoft trust score is 0 out of 100, indicating a strong malicious reputation. The campaign is identified as a cryptocurrency‑related scam targeting users of the OpenSea marketplace. Defenders should add openseas.jp to URL filtering and DNS block lists, and monitor for connections to the associated IP address and name servers. Network sensors should alert on TLS connections using the Let’s Encrypt certificate issued for this domain. User awareness messaging should warn that any “Open Seas” URL is unauthorized and may attempt to harvest cryptocurrency credentials. Ongoing observation is required to detect any payload delivery or credential‑stealing forms that may appear on the site.