airdrope-orca[.]xyz

The domain airdrope-orca.xyz is identified as an active phishing site specializing in brand impersonation. Analysis confirms it targets Orca, a cryptocurrency platform, by mimicking legitimate airdrop campaigns to deceive users into disclosing credentials or transferring assets. The domain remains operational as of the latest verification. Infrastructure analysis reveals the domain was registered on June 17, 2026, through GMO Internet, Inc. It resolves to the IP address 184.86.103.132, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). Security vendors on VirusTotal have flagged this domain, with 3 out of 95 detecting malicious activity. The SSL certificate is issued by GoDaddy.com, specifically under the GoDaddy TLS Intermediate CA DV - R1v1 chain. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its malicious intent. Current status indicates the domain is still active, posing an ongoing threat to users. Organizations and individuals are advised to block the domain and its associated IP address at the network level. End-users should be alerted to avoid interacting with any communications or websites linked to airdrope-orca.xyz. Security teams are recommended to monitor for related domains using similar naming conventions and to update detection rules to include this domain in threat intelligence feeds.