finance-with-open-ocean[.]pages[.]dev

PhishDestroy identifies finance-with-open-ocean.pages.dev as a live credential-stealing page masquerading as a legitimate financial platform. The domain delivers a crypto-drainer kit designed to harvest wallet login credentials and private keys from unsuspecting users who mistakenly enter sensitive data into the fake login portal. No brand impersonation was detected in the payload, indicating the operators may be testing a generic financial-themed lure to broaden victim scope before targeting specific institutions.

Technical indicators show the site resolves to IP 188.114.96.3 and is registered through Cloudflare, Inc. VirusTotal scans return 0 detections out of 95 engines, while the SSL certificate is issued by Google Trust Services. The domain was created under Cloudflare’s Pages platform, which provides free hosting and can be rapidly redeployed, complicating takedown efforts. As of this report, the domain is not listed on major blocklists such as Google Safe Browsing and remains active in the wild with low detection coverage.

This domain is currently under active investigation with status marked as 'under_investigation'. Response actions include domain reputation flagging and hashing distribution to browser security partners. Remaining risk is assessed as moderate due to low AV coverage and lack of blocklisting, combined with the domain’s rapid hosting environment. Users are strongly advised to verify any finance-related login page using PhishDestroy before entering credentials or wallet information. The absence of immediate detection underscores the need for real-time threat intelligence tools in preventing credential theft.