secure-nft-guide[.]pages[.]dev

Analysis of secure-nft-guide.pages.dev shows a clear brand‑impersonation campaign targeting OpenSea users. The site presented the page title "OpenSea Wallet Login | Connect Wallet Securely" and returned an HTTP 403 status, indicating that the server was configured to block direct access after detection. Infrastructure inspection reveals the domain was hosted on Cloudflare’s network (AS13335) with the IP address 172.66.47.182 located in the United States. The DNS configuration lists four Cloudflare nameservers (harmony.ns.cloudflare.com, malcolm.ns.cloudflare.com, ns.cloudflare.com, ns2.cloudf), confirming that the registrar is Cloudflare, Inc. The TLS certificate is issued by Google Trust Services under the WE1 profile, providing a valid HTTPS chain but offering no assurance of legitimacy.

Security scanners on VirusTotal flagged the domain in 16 out of 95 vendors, and a Gridinsoft trust score of 0 / 100 further underscores the malicious nature. The domain is listed on at least one public blocklist and has been taken offline by the mitigation service PhishDestroy. The creation date of October 31 2025 indicates a relatively recent registration, consistent with fast‑flux phishing operations. The campaign’s stated objective is wallet or seed phishing, aiming to harvest private keys from OpenSea users.

While the page content has not been captured, the combination of brand‑specific page title, Cloudflare hosting, valid SSL, and multiple vendor detections provides strong evidence of a fraudulent login portal. Defenders should continue to block the domain at network perimeter, update URL filtering rules, and monitor for any resurgence of similar subdomains under the pages.dev suffix. Users should be warned not to enter credentials on any site mimicking OpenSea’s login flow, especially those lacking official OpenSea domain signatures.