revert-finance-orca[.]typedream[.]app

The domain revert-finance-orca.typedream.app was observed hosting a site whose title reads "Revert Finance Orca: Analyze Your Orca LP Positions with Ease," indicating a clear attempt to impersonate the Orca brand. Technical fingerprinting shows the site was built on a Node.js stack using React, Next.js, and Google Cloud services, including Cloud Trace and the Cloudflare CDN. The SSL certificate is issued by Google Trust Services under the WE1 identifier, confirming the use of a legitimate certificate authority but not the legitimacy of the content. DNS resolution points to the IP address 172.67.6.36, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States.

Nameserver delegation to annalise.ns.cloudflare.com and darwin.ns.cloudflare.com further confirms Cloudflare as the hosting provider. The domain was registered through Squarespace Domains II LLC on January 22, 2021, and the registrar information is publicly available. An HTTP request returned a 404 status, suggesting the page may have been taken down or is no longer serving content. Threat intelligence indicates the site appears on a single security blocklist and was blocked by PhishDestroy.

VirusTotal analysis recorded 15 detections out of 93 scanned security vendors, reinforcing the malicious classification. The current operational status is offline, limiting immediate interaction but preserving forensic artifacts. Defenders should continue to monitor the associated IP range and Cloudflare edge nodes for similar brand‑impersonation deployments, enforce domain‑based blocklists for the full domain string, and consider adding the IP 172.67.6.36 to network‑level deny lists. Additional investigation is warranted to determine whether the underlying infrastructure hosts other phishing or malware payloads, given the shared hosting environment typical of Cloudflare customers.