finance-with-open-ocean-8vd[.]pages[.]dev

The domain finance-with-open-ocean-8vd.pages.dev is currently active and hosts a page titled “OpenOcean Finance: Features, Platform Guide & FAQs”. The site is registered through Cloudflare, Inc. and uses Cloudflare’s DNS infrastructure (beau.ns.cloudflare.com, mimi.ns.cloudflare.com). All traffic resolves to the Cloudflare edge address 172.66.47.139 located in Canada, and the site serves content over HTTPS with a Google Trust Services certificate (WE1) and enforces HSTS while supporting HTTP/3. VirusTotal analysis shows that 7 of 91 scanned security vendors flagged the domain, indicating a moderate level of malicious suspicion. The domain is listed on at least one public blocklist and is actively blocked by PhishDestroy. Additional reputation data includes a Gridinsoft trust score of 0 out of 100 and a single entry on a security blocklist. The domain was created on 27 April 2026, which aligns with the recent emergence of the observed activity. Analysis indicates that the domain is being used to impersonate the legitimate “OpenOcean Finance” service, as suggested by the page title. However, the actual content of the page has not been examined, so the specific tactics (credential harvesting, malicious redirects, etc.) remain unknown. The presence of Cloudflare’s protection and a valid TLS certificate does not mitigate the risk, as threat actors frequently leverage reputable hosting to increase credibility. Defenders should block the domain at the network perimeter, add the underlying IP address to deny lists, and monitor DNS queries for the associated Cloudflare nameservers. Continuous scanning of the site for payloads and credential‑phishing forms is recommended, as is sharing the indicator with threat‑intel platforms to improve collective detection.