connect-opensea-logi[.]pages[.]dev

The domain connect-opensea-logi.pages.dev was registered through Cloudflare on February 21, 2026 and resolves to the IP address 172.66.47.50, which belongs to AS13335 Cloudflare, Inc. in the United States. The site is protected by HSTS, serves HTTP/3 traffic, and presents a Google Trust Services / WE1 SSL certificate. HTTP requests receive a 403 response and the page title returned by the server is "Suspected phishing site | Cloudflare," indicating that the hosting provider has flagged the content as potentially malicious. Reputation data shows the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service.

VirusTotal analysis recorded 11 detections out of 93 scanned security vendors, reinforcing the suspicion of malicious activity. The Gridinsoft trust score is 0 out of 100, the lowest possible rating, and the domain’s nameservers are listed as jerry.ns.cloudflare.com and desi.ns.cloudflare.com. Current operational status is "offline," suggesting the site has been taken down or is no longer reachable. The known intelligence classifies the activity as a crypto‑related scam that impersonates the OpenSea brand, confirming a brand‑impersonation threat.

While the technical indicators strongly support a malicious classification, no public content has been captured to detail the specific payload or credential‑harvesting mechanisms employed. Defenders should continue to block the domain at network perimeters, ensure that any internal DNS resolvers deny queries for this FQDN, and monitor for related indicators such as traffic to the associated Cloudflare IP range. Additional scrutiny of logs for attempts to contact the domain after the reported offline status is advisable, as threat actors may reactivate the infrastructure under a different subdomain or host.