get-opense[.]pages[.]dev

This domain, get-opense.pages.dev, was observed hosting a page titled “OpenSea™ Wallet Login | Secure NFT & Wallet Portal,” indicating a brand‑impersonation campaign targeting OpenSea users. The site was provisioned on 21 February 2026 and is registered through Cloudflare, Inc., using the nameservers abdullah.ns.cloudflare.com and clara.ns.cloudflare.com. DNS resolution points to IP address 172.66.44.91, which belongs to Autonomous System AS13335 operated by Cloudflare in the United States. The HTTP response returned a 403 status code, and the server advertises HSTS and HTTP/3, confirming the presence of modern Cloudflare edge services.

TLS termination is provided by a Google Trust Services certificate (WE1), indicating a valid certificate chain despite the malicious intent. Detection telemetry shows that two of ninety‑three VirusTotal security vendors flagged the domain, and the domain appears on a single external blocklist. Google Safe Browsing classifies the site as “social engineering,” while PhishDestroy has already blocked it. Gridinsoft assigns a trust score of zero out of one hundred, reflecting extreme risk.

The page title and brand target are the only content‑level indicators available; no additional page content has been captured. Given the combination of a recent registration, Cloudflare‑hosted infrastructure, a valid TLS certificate, and low detection counts, the domain is likely to have been used for a short‑lived credential‑harvesting operation that has since been taken offline. Defenders should continue to monitor the associated IP address and Cloudflare nameservers for any re‑use, update internal URL blocklists with the full domain, and enforce strict URL filtering for any requests to pages containing the “OpenSea™ Wallet Login” title. Users should be warned that legitimate OpenSea services never use a “pages.dev” subdomain for authentication, and any attempt to enter credentials on such a site should be rejected.