defualt-orca-finance[.]pages[.]dev

PhishDestroy identifies defualt-orca-finance.pages.dev as an active crypto drainer posing as a financial platform to steal user credentials and private keys. This domain leverages Cloudflare Pages hosting and a Google Trust Services SSL certificate to appear legitimate, targeting victims through impersonation of legitimate finance services. The infrastructure is designed to evade early detection, relying on Cloudflare’s reputation and TLS encryption to bypass initial scrutiny.

This domain was flagged by PhishDestroy with 0 detections on VirusTotal as of the latest scan, indicating it remains undetected by most antivirus engines. The host resolves to IP 172.66.47.138 via Cloudflare’s infrastructure, a common tactic among phishing operators to mask origin and complicate takedown efforts. The use of Google Trust Services for SSL further enhances its credibility, reducing user suspicion. As of seed ca70c3, no blocklist entries have been recorded, suggesting this threat is still emerging and widely unmitigated.

Users who have visited defualt-orca-finance.pages.dev should immediately cease any interaction, disconnect from the site, and avoid entering credentials, wallet addresses, or private keys. Clear browser cache and cookies related to the domain. Scan your system with updated antivirus software, monitor financial and wallet accounts for unauthorized transactions, and report the domain to PhishDestroy and relevant cybersecurity authorities. If you entered sensitive data, revoke connected wallet permissions and initiate a security audit of your accounts.