live-openseasmint16[.]vercel[.]app

The domain live-openseasmint16.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on a Vercel infrastructure that advertises HSTS. DNS resolution points to IP address 64.29.17.131, which belongs to the Amazon.com, Inc. ASN16509 operating out of the United States. The TLS certificate presented is issued by Google Trust Services under the WR1 identifier, indicating a legitimate certificate chain but offering no assurance about the underlying content. HTTP responses from the host return status code 451, and the page title reported by scanners is "Deployment Unavailable," suggesting that the site has been taken offline.

Despite the offline status, the domain appears on four security blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that threat intelligence feeds have flagged it as malicious. VirusTotal analysis shows that 15 of 93 security vendors have flagged the domain, reinforcing the suspicion of malicious activity. The site is categorized as a crypto scam that impersonates the OpenSea brand, aligning with the reported brand target and scam type.

Evidence indicates that the threat actor leveraged a reputable hosting provider and a valid SSL certificate to increase perceived legitimacy, a common tactic in brand impersonation campaigns. Defenders should continue to block the domain and its associated IP address at network perimeter devices, update URL filtering policies, and monitor for any residual activity that might persist after takedown. Given the limited visibility beyond the page title, further investigation of any archived content or associated payloads is recommended to fully assess the scope of the campaign.