orca[.]mrexcel[.]asia

Analysis of the domain orca.mrexcel.asia indicates that it is currently active and under investigation for generic phishing activity. The domain has been blocked by three independent threat‑filtering products—PhishDestroy, MetaMask, and SEAL—and appears on three publicly available security blocklists, which confirms that multiple defenders have observed malicious use. VirusTotal records show that the domain was submitted for scanning and examined by 91 antivirus and URL‑reputation engines; none of the vendors generated a detection at the time of the scan.

While the absence of detections does not constitute proof of safety, it does demonstrate that the domain has not yet triggered known signatures in those engines. No additional telemetry such as registrar information, hosting IP, SSL certificate details, HTTP response codes, or page‑title metadata is available in the current intelligence set. Consequently, the precise infrastructure supporting the domain, its geographic origin, and the exact phishing payload remain unknown.

Defenders should treat the domain as hostile: add it to URL filtering and DNS block lists, monitor for any outbound connections to the domain, and, if possible, capture traffic for sandbox analysis should a user attempt to visit the site. Continuous re‑evaluation is advised, as further evidence may emerge that clarifies the scope of the phishing campaign.