open-sea-logn-auth[.]pages[.]dev

Analysis of open-sea-logn-auth.pages.dev shows a newly registered domain created on February 21, 2026 that is being used to impersonate the OpenSea brand in a crypto‑related scam. The domain is registered through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.97.3, which is associated with ASN 13335 and located in the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, indicating a valid TLS handshake despite the malicious intent. Requests to the site return HTTP 403, and the page title returned by the server is "Suspected phishing site | Cloudflare," confirming that the host is flagged by Cloudflare’s own detection mechanisms.

Technical fingerprints include enforced HSTS, Cloudflare services, and HTTP/3 support. Reputation signals are strongly negative: a Gridinsoft trust score of 0 / 100, appearance on one external security blocklist, and a detection by PhishDestroy. VirusTotal scans show that 2 of 93 security vendors have flagged the domain, reinforcing the malicious classification. The site is currently offline, consistent with the "taken offline" status reported.

While the exact phishing page content has not been captured, the available evidence—brand impersonation of OpenSea, crypto‑scam labeling, and multiple independent security alerts—indicates a high likelihood of credential harvesting or fund diversion attempts. Defenders should block the domain at perimeter firewalls and DNS filtering solutions, update any threat intel feeds with the domain and its associated IP, and monitor for related Cloudflare‑hosted subdomains that may be leveraged in future campaigns. Continuous re‑evaluation is advised in case the infrastructure is re‑activated or additional indicators emerge.