feq-us-opensealogin[.]pages[.]dev

The domain feq-us-opensealogin.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.89, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and is classified as a brand‑impersonation campaign targeting OpenSea, with the underlying scam type identified as a crypto scam. Transport security is provided by a Google Trust Services certificate issued under the WE1 identifier, and the server enforces HSTS while supporting HTTP/3, indicating a modern Cloudflare deployment. HTTP responses return a 403 status code, suggesting the content is currently inaccessible.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single blocklist—PhishDestroy. Google Safe Browsing flags the URL for social engineering, and VirusTotal reports that 12 of 95 scanned security vendors have flagged the domain as malicious. The authoritative nameservers tess.ns.cloudflare.com and edward.ns.cloudflare.com are consistent with the registrar’s infrastructure.

While the site is offline at the time of analysis, the combination of brand impersonation, crypto‑scam labeling, low trust score, blocklist inclusion, and multiple vendor detections provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds with the listed blocklist identifiers, and monitor for any re‑hosting attempts that may arise from the same Cloudflare IP range or similar sub‑domains. Additional investigation of associated IPs and certificate metadata may reveal further infrastructure used by the threat actor.