indirecting-openocean-swap[.]pages[.]dev

The domain indirecting-openocean-swap.pages.dev was registered on 2026-04-04 through Cloudflare, Inc. and is currently hosted on Cloudflare’s edge network (IP 188.114.96.3, located in Canada). The authoritative nameservers are anna.ns.cloudflare.com and eugene.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) is present, indicating use of HTTPS. The site returns HTTP 200 and the page title reads “OpenOcean Swap | Multi‑Chain DeFi Swaps Made Simple and Secure”, suggesting an attempt to impersonate a DeFi swapping service. The domain has been added to the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal reports a single detection out of 94 scanning engines, and Gridinsoft assigns a trust score of 0/100. The risk rating is listed as high and the domain is marked active. Analysis indicates that the infrastructure—Cloudflare DNS and edge hosting, a legitimate‑looking TLS certificate, and a recent registration—are consistent with fast‑flux or abuse‑as‑a‑service phishing operations. The presence of a DeFi‑related title points to a likely credential‑harvesting campaign targeting cryptocurrency users. No further content analysis is available; the page’s HTML, scripts, or form fields have not been disclosed. Defenders should add the domain to URL filtering and firewall deny lists, monitor DNS queries for the associated nameservers, and enforce multi‑factor authentication for any services that could be targeted. Continuous re‑scanning of the domain on threat intelligence platforms is advised to capture any emerging indicators.