0pensea[.]cn

The domain 0pensea.cn was registered on 21 April 2022 through Web Commerce Communications Limited. DNS resolution points to 103.125.85.169, an address announced by AS132825 (MYTEK TRADING PTY LTD) located in Hong Kong. The authoritative nameservers are b.share-dns.net and a.share-dns.com, and no TLS certificate is presented for the host, indicating an HTTP‑only service. The site title returned by the HTTP response is “OpenSea Exchange Official Website | The World's Leading NFT Trading Platform‑OpenSea Download Wallet App”, which references the OpenSea brand while the threat profile lists the target brand as MetaMask. This mismatch suggests a credential‑stealing page that attempts to lure MetaMask users under the guise of an OpenSea download.

VirusTotal has recorded 14 detections out of 95 scanners, and the domain appears on four public blocklists. AlienVault OTX references the domain in 18 threat‑intel pulses. Independent blocklist services PhishDestroy, MetaMask, ScamSniffer and Enkrypt have all marked the domain as malicious. Scamadviser assigns a trust score of 1 / 100, reinforcing the low reputation. The overall classification is a crypto‑scam, consistent with the brand‑impersonation intent.

Evidence gaps remain: the exact page content, form fields, and any payloads have not been captured, and the current offline status prevents live verification of response headers or redirect behavior. Defenders should continue to block 0pensea.cn at network perimeter and DNS layers, add the IP 103.125.85.169 to host‑based deny lists, and monitor for any re‑hosting attempts using the same nameserver pair or similar page titles. Incident response teams should also alert users of MetaMask and OpenSea about the fraudulent site, referencing the observed title and lack of TLS. Ongoing intelligence collection is advised to detect possible re‑registration or migration to new infrastructure.