opensea-login-help-cpp[.]pages[.]dev

opensea-login-help-cpp.pages.dev was observed on July 23, 2026 as a high‑risk brand‑impersonation site targeting OpenSea users. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers rodrigo.ns.cloudflare.com and robin.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.148, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The server presents a TLS certificate issued by Google Trust Services under the WE1 root, indicating a valid SSL handshake but offering no assurance about the underlying content.

HTTP requests return status code 403 and the response includes HTTP/3 support and HTTP Strict Transport Security (HSTS) headers, both typical of Cloudflare‑fronted services. Automated analysis by Gridinsoft assigned a trust score of 0 out of 100, and Google Safe Browsing flags the site for social engineering. VirusTotal scanned the domain with 14 of 95 security vendors reporting a detection, and the domain appears on one public blocklist, where it has been cited by PhishDestroy as a crypto‑scam vector. The page title presented by the server is “Suspected phishing site | Cloudflare”, confirming that the host is currently inaccessible and showing Cloudflare’s default block page.

No additional information about the page content, login forms, or phishing kit has been disclosed. The limited evidence suggests that the infrastructure is deliberately hidden behind Cloudflare’s proxy, employing a freshly registered domain and legitimate SSL to increase credibility. Defenders should block the domain at DNS and firewall layers, monitor for similar Cloudflare‑hosted domains that resolve to the same IP range, and propagate the indicator set to endpoint protection solutions. Continued observation of Cloudflare‑issued certificates and any future re‑activation of the domain is recommended, as the threat actor may re‑deploy the same infrastructure under a new domain name.