opensaea-logn[.]pages[.]dev

The domain opensaea-logn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 188.114.97.3 (AS13335, United States). DNS is served by lilyana.ns.cloudflare.com and maciej.ns.cloudflare.com. The site presented an HTTPS endpoint signed by Google Trust Services / WE1 and advertised HSTS and HTTP/3 support, indicating a modern TLS configuration. A page title captured from the site reads “OpenSea™ Login — Secure Wallet Access & Step‑by‑Step,” which aligns with the listed scam type of credential phishing targeting the OpenSea brand.

The HTTP response returned a 403 status code, and the domain is currently taken offline. Security intelligence shows the domain appears on one blocklist and is specifically listed by PhishDestroy. VirusTotal scans recorded nine detections out of ninety‑three vendor engines, and Google Safe Browsing flags the domain for social engineering. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification.

While the offline status prevents direct content inspection, the combination of a brand‑targeted page title, multiple vendor detections, blocklist listings, and a zero trust score provides strong evidence that the domain is being used for credential harvesting. Defenders should add the domain to network deny lists, monitor DNS queries for the associated IP address and nameservers, and enforce URL filtering that blocks known phishing and social‑engineering URLs. Continuous re‑evaluation is recommended in case the site is reactivated, and any captured credentials should be treated as compromised.