be-opensea[.]com

Analysis indicates that the domain be-opensea.com was registered on 17 July 2025 through Hosting Concepts B.V. d/b/a Registrar.eu. The domain resolves to the IPv4 address 45.139.104.34, which is allocated to AS399979 (49.3 Networking LLC) and geolocated to Germany. The hosting server presents a Plesk Obsidian 18.0.70 control-panel page title, suggesting the site is hosted on a default Plesk installation rather than a custom phishing landing page. The SSL certificate is rated R10, indicating a low trust level, and the Gridinsoft trust score for the domain is 0 out of 100. VirusTotal scans show that six of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious activity.

The domain is currently listed on two public blocklists—PhishDestroy and ScamSniffer—and both blocklists have marked it as a crypto‑related scam that impersonates the OpenSea brand. The reported scam type is a crypto scam, but no further details about the payload or lure have been observed. The site’s HTTP status is offline at the time of reporting, which limits immediate threat exposure but does not preclude future re‑activation. Defenders should continue to block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions.

Monitoring for re‑registration or resurrection of the site, as well as for any new sub‑domains that resolve to the same IP range, is recommended. Given the recent creation date, low trust scores, and the presence on multiple blocklists, the domain should be treated as an elevated‑risk indicator of brand‑impersonation activity targeting OpenSea users. Further investigation is warranted if the site becomes reachable again, particularly to capture any login‑capture forms or malicious payloads that may be deployed. Sharing the observed indicators of compromise with threat‑intel sharing platforms can help accelerate detection across the ecosystem.