opnesee-login[.]pages[.]dev

The domain opnesee-login.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.46.226, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution is served by the authoritative name servers holly.ns.cloudflare.com and kenneth.ns.cloudflare.com. When accessed, the site returns an HTTP 403 response and presents the page title "Suspected phishing site | Cloudflare," indicating that the content has been flagged by Cloudflare's own protection mechanisms. The SSL certificate presented is issued by Google Trust Services under the WE1 hierarchy, confirming that TLS termination is performed by Cloudflare's edge network. Technical fingerprints show the presence of HTTP/3 and HSTS, consistent with modern Cloudflare deployments.

Threat intelligence classifies the domain as a brand impersonation campaign targeting OpenSea. The site appears on one external security blocklist and is actively blocked by the PhishDestroy service. Google Safe Browsing has flagged the URL for social engineering, and VirusTotal analysis shows that 9 of 93 scanning engines have raised detections against the domain. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

Observations indicate that the domain is currently offline, likely due to takedown or hosting removal actions. No additional content or page behavior has been captured beyond the Cloudflare warning page, so the exact phishing vector (e.g., credential capture form) remains unverified. Defenders should continue to block the IP 172.66.46.226 and the fully qualified domain name, incorporate the domain into existing URL filtering and email security policies, and monitor for any re‑registration of the sub‑domain pattern.