open-sea-io-cdn[.]pages[.]dev

The domain open-sea-io-cdn.pages.dev was observed on July 23, 2026 and is currently listed as offline. Registration information indicates the domain was created on February 21, 2026 and is hosted through Cloudflare, Inc., with authoritative nameservers eve.ns.cloudflare.com and jaxson.ns.cloudflare.com. DNS resolution points to the IP address 172.66.44.91, which belongs to AS13335 Cloudflare and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming that the site leveraged a valid HTTPS connection.

HTTP response headers include HSTS and the site supports HTTP/3, both typical of Cloudflare‑served content. The page title returned by the server is “OpenSea Wallet Log In - Secure NFT Access”, and the domain is explicitly marked as impersonating the OpenSea brand, consistent with a wallet/seed phishing campaign. VirusTotal has recorded five positive detections out of ninety‑three scanners, and the domain appears on a single external blocklist maintained by PhishDestroy. Independent reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification.

The HTTP status code observed was 403, indicating that direct content retrieval was blocked at the time of testing. While the available data confirms the infrastructure, the exact phishing payload and any associated command‑and‑control endpoints remain unknown because the site was not reachable for content analysis. Defenders should continue to block the domain at network perimeter, add the IP address 172.66.44.91 to deny lists, and monitor for any future re‑registration of similar subdomains under the pages.dev namespace. Ongoing vigilance is advised for credential‑harvesting attempts targeting OpenSea users, especially those that reference wallet access or seed phrases.