finance-opennocean-io[.]pages[.]dev

PhishDestroy identifies finance-opennocean-io.pages.dev as a live phishing domain posing as a fake login portal targeting cryptocurrency users. The site is hosted on a Cloudflare Pages domain that resolves to IP address 188.114.96.3. It uses a Google Trust Services SSL certificate to appear legitimate, but its primary function is to harvest login credentials or seed phrases from unsuspecting visitors.

Evidence supporting this threat assessment includes a VirusTotal detection rate of 1 out of 95 security vendors, domain registration through Cloudflare, Inc., and an active presence on known blocklists. The domain leverages a .pages.dev subdomain structure commonly abused in credential-phishing campaigns to impersonate legitimate financial services. Users should treat any interaction with this domain as high-risk and avoid entering sensitive information.

If you visited this domain and entered credentials or wallet-related details, immediately revoke any exposed API keys or seed phrases using your official wallet application, enable two-factor authentication, and scan your device with updated antivirus software. Report the incident to PhishDestroy for domain blacklisting and monitor your accounts for unauthorized transactions. Do not reuse passwords or share recovery phrases on unfamiliar websites.