opensee-login-en[.]pages[.]dev

This domain is classified as a high-risk credential phishing infrastructure, designed to harvest user login credentials through fraudulent login portals. Analysis indicates the domain was actively used to impersonate legitimate services, tricking victims into submitting sensitive authentication details. Infrastructure analysis reveals the domain was registered on October 07, 2025, through Cloudflare, Inc. and resolved to the IP address 172.66.44.78, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). Security vendors detected the domain on VirusTotal with 17/95 flags, while it appears on two blocklists: PhishDestroy and PhishingDB. Google Safe Browsing also categorizes it as phishing. The page title, 'Suspected phishing site | Cloudflare,' further confirms its malicious intent. Mitigation requires immediate action to prevent credential theft. Network administrators should block the domain and its resolving IP (172.66.44.78) at the firewall or DNS level. End users must be educated to recognize phishing indicators, such as mismatched URLs and unsolicited login requests. Organizations should enforce multi-factor authentication (MFA) to reduce the impact of stolen credentials. Monitoring for similar domains registered via Cloudflare or resolving to Cloudflare IPs may help identify related threats.