openocean-financ-cdn[.]pages[.]dev

This domain, openocean-financ-cdn.pages.dev, is confirmed to host a crypto drainer phishing operation targeting users of OpenOcean Finance, a decentralized finance (DeFi) aggregation platform. Analysis of the page title, "OpenOcean Finance — Comprehensive DeFi Aggregation Platform," indicates brand impersonation designed to deceive victims into connecting wallets, leading to unauthorized token transfers. No specific drainer kit signature has been identified, but the infrastructure aligns with known crypto theft campaigns targeting DeFi users. Infrastructure analysis reveals the domain was registered on April 27, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.73, geolocated in Canada. VirusTotal detection shows 1 of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted domains. No Google Safe Browsing (GSB) flags were observed at the time of analysis. The domain remains active and unmitigated, posing a high risk to users who may interact with it. Current response actions are limited to a single blocklist entry, leaving potential victims exposed. Organizations and individuals are advised to block the domain and IP at the network level, monitor for wallet connection attempts to this endpoint, and educate users on verifying DeFi platform authenticity before engaging with smart contracts.