secure[.]api-listing-opensea[.]com

secure.api-listing-opensea.com was registered on September 10, 2024 through Hosting Concepts B.V. d/b/a Registrar.eu. The domain resolves to the Amazon Web Services address 15.197.130.221, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. No TLS certificate is presented, indicating that the site operates without HTTPS protection. The page title returned from the host is “api-listing-opensea.com”, matching the domain label and providing no additional context. The domain is associated with a crypto‑scam profile and explicitly impersonates the OpenSea marketplace, as indicated by the brand target field.

VirusTotal records show that 14 of 95 security vendors have flagged the domain, and it appears on a single external blocklist. PhishDestroy has already blocked the host, and the current status is offline after takedown actions. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Nameserver delegation includes ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu, ns1.openprovider.nl, and ns2.op, a mix of registrar‑provided and third‑party servers that may be reused for other abusive domains.

The available evidence confirms elevated risk, but no additional payload or command‑and‑control infrastructure has been publicly disclosed. Defenders should add the IP address 15.197.130.221 and the domain secure.api-listing-opensea.com to network‑level deny lists, monitor for any future resolution to the same address, and watch for similar sub‑domains that reuse the same registrar or nameserver set. Continuous re‑scanning with multi‑vendor engines is recommended to capture any new detections. Organizations that interact with the OpenSea platform should alert users to the existence of this impersonating domain and reinforce safe‑login practices.