open-sea-io-lgon[.]pages[.]dev

PhishDestroy has identified open-sea-io-lgon.pages.dev as a brand impersonation threat targeting OpenSea, a popular NFT marketplace. This domain was specifically crafted to mimic the official OpenSea login portal, complete with a page title reading "OpenSea™ Login — Secure Wallet Access & Step-by-Step Guide" to deceive users into believing they are on a legitimate site. The threat type is a phishing campaign designed to harvest login credentials and potentially deploy crypto drainers, as the fake interface prompts users to connect their wallets.

Technical analysis reveals that this domain has been flagged by Google Safe Browsing as phishing, and VirusTotal reports a detection rate of 9 out of 95 security vendors. It was registered through Cloudflare, Inc. on September 17, 2025, and resolves to IP address 172.66.47.5. The SSL certificate is issued by Google Trust Services (WE1), which adds a false sense of security. The domain appears on one security blocklist, and the page is currently offline.

As of now, the domain has been taken offline, reducing the immediate risk. However, users who may have visited the site before it was deactivated should change their OpenSea passwords and enable two-factor authentication immediately. PhishDestroy advises all users to always verify URLs before entering sensitive information and to use PhishDestroy's domain checker for real-time threat assessments. While the domain is inactive, similar phishing campaigns may emerge, so ongoing vigilance is recommended.