connect-opensea-d2r[.]pages[.]dev

connect-opensea-d2r.pages.dev was registered through Cloudflare on 21 February 2026 and resolves to the Cloudflare‑owned address 172.66.47.24 (AS13335, United States). The domain uses Cloudflare nameservers alla.ns.cloudflare.com and alec.ns.cloudflare.com, presents an HSTS‑enabled HTTPS service with a Google Trust Services / WE1 certificate, and supports HTTP/3. An HTTP request returns a 403 status and the page title “Suspected phishing site | Cloudflare”, indicating that the hosting provider has already taken the site offline. Threat intelligence identifies the site as a brand‑impersonation crypto scam targeting OpenSea.

The page is flagged by Google Safe Browsing for social engineering, and 13 of 93 VirusTotal scanners have reported it as malicious. Independent blocklists, including PhishDestroy, have listed the domain, and it appears on one additional security blocklist. The Gridinsoft trust score of 0 / 100 further confirms the lack of benign reputation. Although the site is currently inaccessible, the combination of registrar information, hosting infrastructure, SSL configuration, and multiple vendor detections provides strong evidence of a malicious operation.

Defenders should ensure that the domain is explicitly denied at perimeter firewalls, DNS filtering services, and proxy layers. Existing detection rules should be updated to include the domain and its associated IP address 172.66.47.24. Continuous monitoring of Cloudflare‑hosted assets for new subdomains that mimic OpenSea or other high‑value brands is recommended, as the attacker may reuse the same infrastructure for future campaigns.