pensa[.]ir

pensa.ir is a phishing domain engaged in brand impersonation, specifically targeting users of the OpenSea marketplace. The domain posed as OpenSea to steal login credentials or sensitive information, but no crypto drainer kit was detected. As of the latest assessment, pensa.ir has been taken offline, reducing immediate risk.

Technical analysis reveals that pensa.ir was flagged by 2 of 95 VirusTotal vendors, including Gridinsoft and Webroot, with a Gridinsoft trust score of 0/100. The domain resolves to IP address 185.143.234.120, located in Iran (IR) and hosted by AS205585 Noyan Abr Arvan Co. (Private Joint Stock). It appears on 2 security blocklists: PhishDestroy and Enkrypt. No SSL certificate was issued, and the domain lacked a page title. Technologies detected include ArvanCloud and HTTP/3. MX records point to mail.pensa.ir with priority 10, and nameservers are e.ns.arvancdn.ir and s.ns.arvancdn.ir. Registrar and creation date are not available.

Users who interacted with pensa.ir should take immediate safety steps. Since this was a credential phishing attack impersonating OpenSea, change any passwords entered on the site and enable two-factor authentication on your OpenSea account and associated email. Monitor for unauthorized transactions or account access. Report the domain to OpenSea's security team and to blocklist providers like PhishDestroy and Enkrypt to help protect others.