open-seaa-login[.]pages[.]dev

The domain open-seaa-login.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and is served by the Cloudflare nameservers cris.ns.cloudflare.com and nataly.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to Cloudflare's network in Canada. The site presents a HTTP status code of 403 and advertises HSTS, HTTP/3, and Cloudflare as its underlying technologies. The only visible page title is "Suspected phishing site | Cloudflare," indicating that the content has been taken down or flagged by the hosting provider.

Google Safe Browsing classifies the domain as a social engineering threat, and PhishDestroy has already blocked it. VirusTotal analysis shows that 14 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. The identified scam type is a crypto scam that impersonates the OpenSea brand, suggesting attempts to lure cryptocurrency users into credential harvesting or fund diversion.

The site is currently offline, but the infrastructure—particularly the use of shared Cloudflare IP space and generic nameservers—could be reused for future malicious deployments. Defenders should immediately block the domain and its associated IP address at perimeter and DNS layers, monitor for newly registered subdomains under pages.dev that contain the "open-seaa" pattern, and incorporate the observed vendor detections into threat‑intel feeds. Continuous re‑evaluation of Cloudflare‑hosted assets for similar brand‑impersonation indicators is recommended to mitigate repeat abuse.