oridion[.]xyz

The domain oridion.xyz was a brand-impersonation phishing site that posed as a Solana privacy tool to harvest wallet credentials through a fake 'Wallet Connect' prompt. It did not deploy a known crypto-drainer kit but instead relied on social engineering to trick users into exposing private keys or seed phrases. At the time of analysis, oridion.xyz was taken offline and no longer served malicious content.

Technical indicators show oridion.xyz was registered through Go Daddy, LLC on October 28, 2023. It resolved to the IP address 172.67.177.122, hosted on Cloudflare infrastructure in the US. The SSL certificate was issued by Google Trust Services / WE1. Security vendors flagged the domain with 2 of 95 detections on VirusTotal, including Forcepoint ThreatSeeker and SOCRadar, while Google Safe Browsing did not flag it. The domain appeared on 1 security blocklist, PhishDestroy. Observed technologies included Node.js, React, Next.js, and Amazon Web Services, with the page titled 'Solana privacy tool - Oridion Galaxy'.

Users who interacted with oridion.xyz should immediately revoke any token approvals granted to unknown contracts using a tool like Revoke.cash or Etherscan's token approval checker. Transfer remaining funds to a new, secure wallet and monitor transaction history for unauthorized activity. Change passwords for any accounts where credentials may have been reused and enable two-factor authentication. Report the phishing domain to the impersonated brand (Solana) via their official security channels and submit the URL to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in takedown efforts.