opn-sea-lgn-welcom[.]pages[.]dev

The domain opn-sea-lgn-welcom.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline, returning an HTTP 403 status. DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2fb3, which is hosted by Cloudflare (AS13335) and geolocated to the United States. The authoritative nameservers are patrick.ns.cloudflare.com and emma.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. TLS termination is performed by a Google Trust Services certificate identified as WE1, confirming a legitimate‑looking HTTPS endpoint.

The site presented the page title "OpenSea Login | Your Secure Gateway to the NFT Marketplace," matching the known scam type of wallet/seed phishing targeting the OpenSea brand. Detection signals include a Gridinsoft trust score of 0 / 100, placement on a single security blocklist, and a Google Safe Browsing flag for social engineering. Two of ninety‑three VirusTotal scanners flagged the domain, and PhishDestroy has listed it as blocked. The overall risk level is elevated, reflecting the combination of brand impersonation and credential harvesting intent.

Uncertainty remains regarding the exact payload delivered to victims, as no additional forensic artifacts or malware hashes have been disclosed. Defenders should continue to block the domain at network perimeter devices, monitor for traffic to the associated Cloudflare IP range, and update URL filtering rules to include the full domain. Incident response teams receiving reports of compromised OpenSea credentials should verify against the domain’s creation timestamp and consider the possibility of seed phrase theft, applying standard remediation steps for wallet compromise.