opansea-wallet-sign-up[.]pages[.]dev

The domain opansea-wallet-sign-up.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served an HTTP 403 response and presented the page title "Suspected phishing site | Cloudflare". A Google Trust Services / WE1 SSL certificate protected the connection, and the host advertised HSTS, Cloudflare services, and HTTP/3 support.

Threat intelligence categorises the site as a crypto scam, specifically a crypto drainer, and it appears on one security blocklist. VirusTotal scans identified the domain as malicious in 14 of 93 security vendor engines. Google Safe Browsing flagged the domain for social engineering. The domain’s trust score from Gridinsoft is 0 out of 100, indicating an extremely low reputation.

PhishDestroy has also blocked the domain. While the infrastructure details are concrete, the exact payload or victim interaction flow remains unknown because the site is offline and no page content beyond the title has been captured. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat intelligence feeds with the observed indicators, and monitor for any re‑hosting attempts that reuse the same IP range, SSL certificate, or Cloudflare nameservers (moura.ns.cloudflare.com, lara.ns.cloudflare.com). Additional analysis should focus on any associated subdomains or similar naming patterns that may be leveraged in future campaigns.