project-opensea[.]pages[.]dev

The domain project-opensea.pages.dev was first registered on February 21, 2026 and is hosted on Cloudflare’s network (ASN 13335, United States). DNS resolution points to IP address 172.66.47.188, which is owned by Cloudflare, Inc. The domain is served through Cloudflare’s edge infrastructure, presenting an SSL certificate issued by Google Trust Services under the WE1 intermediate, and the connection enforces HSTS and HTTP/3. Nameserver delegation to moura.ns.cloudflare.com and veronica.ns.cloudflare.com confirms the use of Cloudflare’s managed DNS. The site returns an HTTP 403 status code and its page title is “Suspected phishing site | Cloudflare”, indicating that the content has been flagged by Cloudflare’s protective mechanisms.

The domain is listed on a single security blocklist and has been blocked by the PhishDestroy service. Google Safe Browsing classifies the URL as a social engineering threat, and VirusTotal reports that 10 of 93 scanning engines have flagged the domain, reinforcing the malicious assessment. Brand analysis shows the domain is explicitly targeting OpenSea, as indicated by the “Impersonates: OpenSea” field and the “Crypto Scam” classification. The Gridinsoft trust score of 0 / 100 further reflects a lack of legitimacy.

No additional evidence such as page screenshots or payload samples is available, so the exact phishing workflow cannot be confirmed. Defenders should update any URL filtering or DNS sinkhole policies to block project‑opensea.pages.dev, monitor for related sub‑domains under the pages.dev namespace, and consider adding the IP address 172.66.47.188 to threat‑intel feeds if not already present. Continuous re‑scanning of the domain is advised, as the current status is offline but could be re‑activated. Organizations that rely on OpenSea services should educate users about the risk of unsolicited links and encourage verification of URLs before credential entry.