orcaapp-swap[.]com

Analysis of orcaapp-swap.com shows a newly registered domain created on 25 November 2025 that was used to impersonate the Orca brand in a crypto‑scam campaign. The domain is hosted on Cloudflare’s network (AS13335) and resolves to the IP address 188.114.96.3, which is geolocated to the United States. Both authoritative name servers are Cloudflare‑provided (kenia.ns.cloudflare.com and tadeo.ns.cloudflare.com). No TLS certificate is presented; HTTP connections are served without encryption, which is consistent with the observed offline status. Threat intelligence feeds have flagged the domain on a single security blocklist and PhishDestroy has actively blocked it.

VirusTotal scans report that 15 of 95 antivirus and URL‑reputation engines returned a malicious verdict, indicating moderate consensus among detection products. The Gridinsoft trust score is 0 out of 100, reinforcing the classification as high‑risk. The registrar listed for the registration is NiceNIC International Group Co., Limited, a known bulk‑registration service. The observed data points suggest that the infrastructure was deliberately provisioned to host a cryptocurrency‑related fraudulent site targeting users of the Orca platform.

No SSL certificate, no public page title, and the offline status limit current visibility into the exact content that was delivered to victims. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection of the same domain or adjacent subdomains, and add the IP address 188.114.96.3 to deny‑list rules. Organizations that rely on Orca services should educate users about unsolicited requests involving crypto transfers and advise verification through official channels. Ongoing observation of the registrar NiceNIC and the Cloudflare IP range for similar patterns is recommended to pre‑empt future impersonation attempts.