orch-orchids[.]app

Analysis of the domain orch-orchids.app indicates it was actively involved in wallet and seed-phishing operations targeting Solana users, as classified by multiple security vendors. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, and resolved to a Cloudflare-hosted IP address (172.67.192.184) within AS13335. Infrastructure analysis reveals the use of Cloudflare nameservers (kinsley.ns.cloudflare.com and lewis.ns.cloudflare.com), HTTP/3, and HSTS, alongside a Google Trust Services SSL certificate (WE1). The page title, 'Orchids - The AI Developer,' does not directly reference Solana, but the scam type explicitly identified in threat intelligence reports confirms the domain's role in wallet and seed-phishing campaigns impersonating the Solana brand.

At the time of this report (July 22, 2026), the domain returns an HTTP 403 status, suggesting it has been taken offline or restricted. It appears on two security blocklists, including PhishDestroy and ScamSniffer, and was flagged by 2 of 93 security vendors on VirusTotal. Gridinsoft assigned a trust score of 0/100, further supporting its classification as malicious. While the exact content of the phishing page remains unanalyzed, the available evidence—including the scam type, brand target, and detection by specialized anti-phishing tools—confirms its intent to deceive users into disclosing wallet credentials or seed phrases.

Defenders should treat this domain as confirmed malicious infrastructure. Network-level blocking is recommended for the domain and its resolved IP (172.67.192.184). Given the use of Cloudflare, monitoring for re-emergence under new domains or subdomains is advised. No additional brand impersonation or scam categorization beyond Solana wallet phishing is supported by the current evidence.