seatoken[.]finance

The domain seatoken.finance was registered on February 22, 2026 and is currently taken offline. DNS resolution points to the IP address 172.67.201.113, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The domain uses Cloudflare’s default nameservers (donald.ns.cloudflare.com and rachel.ns.cloudflare.com) and does not present an SSL/TLS certificate, indicating that any HTTPS connections would be unsecured or subject to certificate errors. The page title observed during the brief analysis was "OpenSea," aligning the site with a crypto‑related brand, and the overall classification is a crypto scam employing generic phishing techniques.

VirusTotal scans show that three out of ninety‑five security vendors flagged the domain, confirming a low‑to‑moderate detection consensus. The domain appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious reputation. Defenders should treat seatoken.finance as a confirmed malicious indicator and add it to network‑level blocklists, DNS sinkhole configurations, and endpoint protection rules. Monitoring of the associated IP range (172.67.201.0/24) is advisable, as Cloudflare often hosts multiple unrelated domains that may be leveraged for future campaigns.

Because the site is currently offline, content analysis beyond the page title is unavailable; however, the lack of TLS and the rapid registration date suggest a short‑lived campaign targeting OpenSea users. Security teams should educate users about unsolicited requests referencing OpenSea and enforce MFA on crypto platforms. Continuous re‑scanning of the domain is recommended in case it becomes active again, and any resurgence should trigger immediate containment actions.