docs-opnsea-us[.]square[.]site

This domain, docs-opnsea-us.square.site, is identified as a generic phishing site designed to impersonate legitimate cryptocurrency platforms, specifically targeting users of OpenSea or similar services. The site likely aims to harvest login credentials, private keys, or other sensitive financial information by presenting a fraudulent interface that mimics trusted digital asset marketplaces. Analysis indicates the domain is structured to exploit user trust through deceptive branding and urgent prompts, a common tactic in credential theft and financial fraud schemes. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered on February 05, 2019, through MarkMonitor, Inc., a registrar frequently associated with both legitimate and fraudulent domains. It is flagged by 4 out of 95 security vendors on VirusTotal, and appears on three independent security blocklists, including MetaMask and SEAL. The site resolves to the IP address 74.115.51.5 and employs technologies such as Weebly, MySQL, PHP, Vue.js, and reCAPTCHA, alongside Cloudflare for content delivery and DDoS protection. The SSL certificate is issued by Let’s Encrypt, providing HTTPS encryption that may falsely reassure users of legitimacy. Users who have visited docs-opnsea-us.square.site or entered any information on the platform should take immediate action. Disconnect any active sessions and revoke permissions granted to third-party applications linked to the domain. Change passwords and private keys associated with cryptocurrency wallets or accounts accessed during the suspected compromise. Monitor connected accounts for unauthorized transactions and enable multi-factor authentication where available. It is also recommended to clear browser cache, cookies, and stored credentials related to the domain, and to report the incident to relevant security teams or fraud reporting platforms for further investigation.