orochi[.]app

This domain, orochi.app, poses a direct financial threat to cryptocurrency users by impersonating an official airdrop portal for the Orochi network. The fraudulent page, titled 'Orochi Airdrop Claim — Official Orochi Airdrop Portal & Claim Dashboard,' prompts visitors to connect their wallets under the pretense of claiming tokens, a common tactic used to deploy crypto drainers. Such schemes typically exploit smart contract interactions to siphon funds without user consent, often targeting participants in decentralized finance (DeFi) ecosystems who may be less cautious during promotional events. Analysis of the domain infrastructure reveals multiple indicators of malicious intent. The domain was registered on December 7, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with short-lived phishing domains. It resolves to the IP address 172.67.167.199, a hosting provider commonly used to obfuscate the true origin of fraudulent sites. Detection metrics further corroborate its malicious nature: the domain appears on five distinct security blocklists, including Codeesura, Polkadot, ScamSniffer, PhishDestroy, and Enkrypt, while VirusTotal reports 4 out of 95 security vendors flagging it as malicious. These figures suggest a coordinated effort to evade detection while maximizing reach. Users who visited orochi.app and interacted with the site should take immediate remedial action. First, revoke any smart contract approvals granted to unknown or suspicious addresses via wallet management tools. Second, monitor connected wallets for unauthorized transactions and transfer remaining assets to a new, secure wallet if compromise is suspected. Finally, report the domain to relevant threat intelligence platforms to aid in broader mitigation efforts. Given the elevated risk level, affected users are advised to assume their credentials or wallet interactions may have been exposed and act accordingly.