opensea[.]com[.]open-buyer[.]com

The domain opensea.com.open-buyer.com is confirmed as a brand impersonation phishing site targeting OpenSea, a major non-fungible token (NFT) marketplace. This domain was operational as a fraudulent platform designed to deceive users into connecting cryptocurrency wallets under the pretense of legitimate OpenSea services. Analysis indicates the site is currently offline, though prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Tucows Domains Inc. and resolved to the IP address 134.199.231.252, hosted on AS14061 (DigitalOcean, LLC) in the United States. The domain lacked an SSL certificate, a common red flag for fraudulent sites. Security vendors flagged the domain on VirusTotal, with 18 of 95 engines detecting it as malicious. Additionally, it appeared on three security blocklists, including PhishDestroy and MetaMask’s internal threat feeds. The page title, 'Connect wallet | OpenSea,' directly mimics the legitimate OpenSea interface, reinforcing its intent to impersonate the brand. Given its current offline status, this domain may resurface under a different name or infrastructure. Users and organizations are advised to monitor for similar impersonation attempts, particularly those targeting cryptocurrency wallet connections. Blocking the domain and its associated IP (134.199.231.252) at the network level is recommended. Security teams should also review logs for prior connections to this domain and educate users on verifying domain authenticity before interacting with wallet-connect prompts.