ocra-so[.]site

PhishDestroy identifies ocra-so.site as an elevated-risk brand impersonation threat, specifically designed to mimic the legitimate Orca trading platform as part of a broader campaign targeting Bitget users. This type of phishing site often attempts to harvest login credentials or trick victims into connecting their crypto wallets, leading to asset theft. The domain was registered through NameCheap, Inc. on October 26, 2025, and was found to resolve to IP address 67.223.118.116 with an SSL certificate issued by Sectigo Public Server Authentication CA DV R36. VirusTotal analysis shows that 13 out of 95 security vendors flagged the domain as malicious, and it appears on at least one security blocklist. Despite its recent creation, the site's page title of "Orca | Trade" and its clear impersonation of Bitget underscore its deceptive intent. Although the domain is currently taken offline, users who may have encountered it should take immediate precautions. For brand impersonation threats like this, PhishDestroy recommends avoiding any interaction with the site, refraining from entering login credentials or seed phrases, and enabling two-factor authentication on all crypto exchange accounts. If any credentials were entered, they should be changed immediately and the affected accounts monitored for unauthorized activity.