app-ocra[.]so

Analysis of the domain app-ocra.so indicates that it was registered on 25 February 2026 through NameCheap, Inc. The authoritative nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com, and the domain resolves to the IPv4 address 82.25.63.187, which is advertised by AS207043 DEDIK SERVICES LIMITED and geolocated to France. No TLS certificate is presented for the host, confirming the absence of HTTPS support. The site’s HTML title, as captured before the domain was taken offline, reads “Orca | Pools”, and the domain is explicitly listed as impersonating the Orca brand. VirusTotal reports a single positive detection out of 93 scanning engines, indicating at least one vendor identified malicious behavior.

Independent blocklist aggregators have added the domain to four separate security blocklists, and it is currently blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. The overall risk assessment is elevated, and the operational status is recorded as offline. While the available data confirms the domain’s use for brand‑impersonation, the specific phishing kit, payload, or victim interaction flow has not been publicly disclosed.

The lack of an SSL certificate and the offline status limit real‑time observation of malicious content, leaving the exact lure and credential‑harvesting mechanisms uncertain. Defenders should continue to monitor the IP address 82.25.63.187 for any re‑activation, enforce outbound filtering to block connections to the domain and its hosting ASN, and ensure that any corporate or user‑initiated requests to app‑ocra.so are denied by web‑filtering solutions. Adding the domain to internal blocklists and sharing the indicator with threat‑sharing communities will reduce exposure to the identified Orca impersonation campaign.