orion-migration[.]web[.]app

This domain hosts a crypto drainer phishing site targeting users through a fake token migration portal. Visitors are tricked into connecting wallets to a malicious interface designed to siphon funds by exploiting smart contract interactions. The site uses social engineering tactics, including urgency around token migrations, to manipulate victims into approving unauthorized transactions. Analysis indicates the domain is registered through Google LLC and resolves to an IPv6 address (2620:0:890::100) hosted on AS54113 (Fastly, Inc.). The SSL certificate is issued by Google Trust Services (WR4), a common pattern for phishing sites leveraging legitimate infrastructure. Detection data shows 1 of 95 security vendors on VirusTotal flag the domain, while three independent blocklists (PhishDestroy, MetaMask, SEAL) have already classified it as malicious. If you visited orion-migration.web.app, immediately revoke any wallet permissions granted to the site using a blockchain explorer or wallet management tool. Check transaction histories for unauthorized approvals or transfers, particularly those involving token allowances. Reset passwords for any accounts linked to the wallet and enable multi-factor authentication where available. Monitor connected devices for unusual activity, as phishing sites may attempt to harvest additional credentials or install malware. Report the incident to relevant platforms and consider notifying local cybersecurity authorities for further mitigation.