arcswap[.]netlify[.]app

This domain, arcswap.netlify.app, is currently offline and has been taken down, as indicated by the HTTP 404 response and confirmation from the PhishDestroy blocklist. The site was registered on May 09 2018 through Netlify and is hosted on a Netlify infrastructure that enforces HSTS. DNS resolution points to the IPv6 address 2406:da18:b3d:e201::258, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated to Singapore. The TLS certificate presented is a DigiCert Global G2 TLS RSA SHA‑256 2020 CA1 chain, issued by DigiCert Inc, confirming that the site used a valid, publicly trusted certificate at the time it was active.

Security telemetry shows that 14 of 93 VirusTotal scanners flagged the domain, and Google Safe Browsing categorises it as a social‑engineering threat. The domain appears on a single security blocklist and has been reported by PhishDestroy as a malicious site. The page title returned from the host is “Vite + React + TS,” which reflects a generic front‑end development stack and does not provide any visible brand or credential‑capture elements. The intelligence explicitly labels the campaign as a “Crypto Scam” that impersonates the Orca brand, indicating that the operator likely attempted to lure victims with cryptocurrency‑related promises while using Orca’s identity.

Because the site is no longer reachable, active exploitation is unlikely, but the historical presence of a crypto‑focused impersonation campaign suggests that the same threat actor may reuse Netlify‑hosted subdomains or similar naming patterns. Defenders should continue to denylist arcswap.netlify.app, monitor Netlify‑hosted domains that resolve to the same IPv6 prefix or ASN, and enforce outbound filtering for any traffic attempting to contact this address.