nft-logn-opens[.]pages[.]dev

Analysis of the domain nft-logn-opens.pages.dev indicates a brand impersonation campaign targeting OpenSea, a well-known non-fungible token (NFT) marketplace. The domain was registered on November 7, 2025, through Cloudflare, Inc., and resolves to the IPv6 address 2606:4700:310c::ac42:2f5d, hosted on Cloudflare's network (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers (emily.ns.cloudflare.com and harvey.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), suggesting an attempt to appear legitimate through encrypted connections and reputable hosting providers. The domain's page title, 'OpenSea Login,' directly aligns with the identified brand target, OpenSea, reinforcing the likelihood of a phishing or credential-harvesting operation. At the time of assessment, the domain has been flagged by 13 of 95 security vendors on VirusTotal, though this detection rate alone does not confirm malicious intent without additional context.

It also appears on one security blocklist, further indicating potential risk. The Gridinsoft trust score of 0/100 reflects a complete lack of reputation, consistent with newly registered or malicious domains. The domain is currently offline, returning an HTTP 403 status, which may result from takedown efforts or temporary suspension by the hosting provider. Defenders should note that the domain leverages Cloudflare's infrastructure, which is frequently abused for phishing due to its ease of registration and built-in protections that can obscure malicious activity. The use of HSTS and HTTP/3, while typically associated with secure implementations, does not preclude malicious use.

Given the domain's association with a crypto scam, as indicated in the known intelligence, it is likely designed to deceive users into submitting login credentials or wallet information under the guise of OpenSea's platform.