en-opensea-get[.]pages[.]dev

The domain en-opensea-get.pages.dev was created on February 21, 2026 and is currently offline, returning HTTP 403 responses. Infrastructure analysis shows the domain resolves to IP address 172.66.44.213, which belongs to AS13335 Cloudflare, Inc., located in the United States. Registration details indicate the domain was provisioned through Cloudflare, Inc., and uses the authoritative nameservers mina.ns.cloudflare.com and pedro.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 profile, confirming the use of a valid HTTPS endpoint despite the site being taken down. Security assessments reveal a Gridinsoft trust score of zero out of one hundred, indicating an extremely low confidence rating.

The page title returned by the server is "Suspected phishing site | Cloudflare," matching the classification of a brand impersonation campaign targeting OpenSea. Google Safe Browsing flags the domain for social engineering, and nine of ninety‑five VirusTotal scanners have identified it as malicious, reinforcing the suspicion. The site is listed on a single security blocklist and has been actively blocked by PhishDestroy. Detected technologies include HTTP/3, HSTS, and Cloudflare’s edge services, which are typical for fast‑response phishing infrastructure.

The observed indicators collectively point to a crypto‑related scam that leverages OpenSea’s brand to lure victims. While the domain is offline, its historical footprint suggests it was used for credential harvesting or fraudulent cryptocurrency transactions. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any re‑registration attempts. Threat intelligence teams are advised to correlate the IP address and nameserver patterns with other known phishing campaigns to identify potential infrastructure reuse.