orca-swim[.]vercel[.]app

Analysis of the domain orca-swim.vercel.app indicates that it has been actively blocked by the PhishDestroy mitigation service and is listed on a publicly‑available security blocklist. The domain was submitted to VirusTotal, where 91 antivirus and URL‑reputation engines inspected the address; none of the engines returned a malicious classification at the time of scanning. While the absence of detections does not constitute proof of benign behavior, the combined presence on a blocklist and the explicit block by PhishDestroy provide strong operational evidence that the site is being used for phishing or credential‑stealing activities. The sub‑domain resides under the vercel.app namespace, a cloud‑hosting platform that supplies TLS certificates by default.

No TLS anomalies or certificate mismatches have been reported, and the HTTP response observed during the last scan was a standard 200 OK, indicating that the site is reachable and serving content. No additional intelligence such as registrar details, IP address, ASN, or hosting location has been disclosed, leaving the underlying infrastructure opaque to investigators. The classification as generic phishing aligns with the observed blocking behavior, though the specific lure, targeted brand, or credential‑capture mechanism has not been publicly disclosed. Because no content analysis or page‑title information is available, the exact phishing vector, victim profile, and any associated command‑and‑control infrastructure remain unknown.

Defenders should continue to enforce deny‑list rules for this exact host, monitor DNS queries for look‑ups to orca‑swim.vercel.app, and propagate the indicator to endpoint protection, web‑gateway, and URL‑filtering products. Analysts are advised to obtain a live snapshot of the landing page, if feasible, to enrich the profile with page‑title or form characteristics. Until further evidence emerges, the domain should be treated as a high‑confidence phishing threat.