websea[.]at

Analysis of the domain websea.at shows a high‑risk, active infrastructure used for a brand‑impersonation campaign targeting the brand across through a crypto‑focused scam. The domain resolves to IP 95.129.234.137, which is registered to AS57724 DDOS‑GUARD LTD and geolocated to Russia. Authoritative name servers are pns61.cloudns.net, pns62.cloudns.com, pns63.cloudns.net, and pns64.cloudns.uk, indicating use of the CloudNS hosting platform. The site serves an HTTP 200 response and presents a TLS certificate issued by Let’s Encrypt (R13), confirming that encryption is in place but does not mitigate the malicious intent. The page title returned by the server is "Websea Login Portal | Secure Websea Exchange Login Dashboard," which aligns with the declared scam type of a crypto scam and the stated impersonation of across. Reputation data show a Gridinsoft trust score of 0 / 100 and a detection count of 2 out of 93 security vendors on VirusTotal, suggesting limited but notable detection. The domain is listed on a single security blocklist and has been flagged by PhishDestroy, reinforcing the assessment of malicious activity. While the exact content of the landing page has not been examined, the combination of brand impersonation, cryptocurrency terminology, and low trust scores indicates a likely credential‑harvesting or fund‑extraction operation. Defenders should immediately block websea.at at network and DNS layers, add the domain to internal blocklists, monitor for any outbound connections to the associated IP, and watch for related CloudNS name server patterns. Continuous re‑scanning on multi‑engine platforms is advised to capture any changes in detection rates, and incident response teams should treat any credentials or crypto wallet information submitted to this site as compromised.