getting-started-orca-swap[.]pages[.]dev

This domain is flagged as a brand impersonation threat targeting users of Orca, a decentralized exchange operating on the Solana blockchain. The site presents itself as a legitimate platform offering spot trading, perpetual contracts, and lending services under the name Orca Swap, a fabricated service not associated with the authentic Orca protocol. Analysis indicates the domain is designed to deceive users into connecting cryptocurrency wallets or entering sensitive credentials, enabling attackers to drain funds or harvest private keys for unauthorized transactions on the Solana network. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 172.66.46.242. The domain was created on April 12, 2026, though this date may reflect registry manipulation or a placeholder. Despite exhibiting no detections on VirusTotal (0/95 engines), the domain appears on three security blocklists, including MetaMask and PhishDestroy, indicating prior identification as malicious. The site employs HTTP Strict Transport Security (HSTS) and HTTP/3, leveraging Cloudflare’s infrastructure to present a veneer of legitimacy while obscuring its true origin. Users who visited getting-started-orca-swap.pages.dev should immediately revoke any wallet connections made to the site and monitor their cryptocurrency wallets for unauthorized transactions. If credentials or private keys were entered, affected users must transfer assets to a new wallet and assume all previously used keys are compromised. Given the domain’s current offline status, users should remain vigilant for similar impersonation attempts targeting Solana-based decentralized finance platforms. Security teams are advised to update blocklists with the domain and associated IP address to prevent further exposure.