opensea-login-help-io[.]pages[.]dev

The domain opensea-login-help-io.pages.dev was registered through Cloudflare, Inc. on February 21 2026 and is served from the Cloudflare edge network (nameservers troy.ns.cloudflare.com and perla.ns.cloudflare.com). DNS resolution points to IP 172.66.44.103, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presents a TLS certificate issued by Google Trust Services (WE1), confirming that HTTPS is enforced. HTTP analysis returns a 403 status code together with the page title “Suspected phishing site | Cloudflare”, indicating that the content has been taken down by the hosting provider. Detected technologies include HSTS and HTTP/3, both typical of modern Cloudflare deployments.

VirusTotal scans show that four of ninety‑three antivirus engines flagged the domain, providing modest detection confidence. The Gridinsoft trust score is 0 / 100, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. Intelligence categorises the infrastructure as a crypto‑related brand impersonation campaign targeting OpenSea, and the site is labelled a “crypto scam”. At the time of analysis the domain is offline, which aligns with the 403 response and blocklist status.

Evidence confirms the domain’s association with Cloudflare hosting, the use of a legitimate SSL certificate, and a modest level of detection by security vendors. However, no payload, credential‑harvesting page, or further malicious artifacts have been captured, leaving the exact phishing methodology unknown. Defenders should continue to block the domain at DNS and proxy layers, add the IP address 172.66.44.103 to deny lists, and monitor for re‑registration or resurrection of similar subdomains under the same parent zone. Regular re‑scanning with multi‑engine services is advised to capture any future changes in malicious behavior.