faq-io-openseas[.]pages[.]dev

Analysis of the domain faq-io-openseas.pages.dev indicates a high-risk brand impersonation targeting OpenSea, a leading non-fungible token (NFT) marketplace. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is currently offline with an HTTP 403 status, displaying a Cloudflare interstitial page titled 'Suspected phishing site.' Infrastructure analysis reveals the domain resolves to a Cloudflare IP (172.66.47.133, AS13335) in the United States, utilizing Cloudflare nameservers (mary.ns.cloudflare.com and bill.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1), and the site employs HSTS and HTTP/3 technologies, which are consistent with modern web security practices but do not mitigate the domain's malicious intent. Security vendors have flagged this domain as malicious, with 10 of 95 engines on VirusTotal detecting it as harmful.

Google Safe Browsing classifies it as social engineering, and the domain appears on at least one security blocklist. PhishDestroy has explicitly blocked the domain, and Gridinsoft assigns it a trust score of 0/100, further corroborating its fraudulent nature. The scam type is identified as a crypto scam, aligning with the impersonation of OpenSea, a platform frequently targeted for phishing and fraudulent schemes. While the domain is currently offline, defenders should treat it as a confirmed threat.

The combination of brand impersonation, crypto scam classification, detection by multiple security vendors, and blocklist inclusion provides strong evidence of malicious intent. Organizations should ensure this domain is blocked at the network level, and users should be educated about the risks of interacting with similar domains. The exact content of the phishing page is not analysed, but the available evidence supports immediate mitigation actions. No legitimate use case is identified for this domain given its registration details, detection history, and infrastructure.