opensee-wallet-net[.]pages[.]dev

The domain opensee-wallet-net.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IPv6 address 2a06:98c1:3121::3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are aron.ns.cloudflare.com and walt.ns.cloudflare.com, indicating the site is hosted entirely on Cloudflare's network. The site presents an HTTP 403 response and advertises the presence of HSTS and HTTP/3, confirming modern security headers are in place, though the response code suggests the content is not publicly reachable.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing classifies the URL as a social engineering threat, and VirusTotal reports that 11 of 93 scanned security vendors have flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, and the SSL certificate is issued by Google Trust Services under the WE1 certificate profile, which is typical for Cloudflare‑issued certificates. Intelligence tags the site as a Crypto Scam, specifically a crypto drainer, aligning with the observed threat type.

No public content was captured because the site returned HTTP 403 and is offline, so the exact phishing page layout, credential collection mechanisms, or targeted cryptocurrency addresses remain unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resolution to the same IPv6 address or associated Cloudflare nameservers, and update detection signatures to incorporate the observed indicators, including the domain name, the IPv6 address, the Cloudflare nameserver pair, and the Google Safe Browsing social engineering classification.