public-en-orca-swap[.]pages[.]dev

This domain operates as a confirmed phishing infrastructure targeting users of the Orca decentralized exchange on the Solana blockchain. Analysis indicates the site presents a fraudulent "Orca Swap: Step-by-Step Guide to Fast, Low-Cost Token Swaps on Solana" interface, designed to deceive visitors into connecting cryptocurrency wallets. The primary threat involves unauthorized token transfers, where victims unknowingly sign malicious transactions that drain funds from connected wallets. The site mimics legitimate Orca documentation while embedding wallet-draining scripts in the frontend code, a common tactic in cryptocurrency phishing operations. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain public-en-orca-swap.pages.dev, registered through Cloudflare on April 08, 2026, resolves to IP address 172.66.44.96 and uses an SSL certificate issued by Google Trust Services. Security vendors have flagged this domain at a rate of 3/95 on VirusTotal, while it appears on three independent security blocklists. Additional protective measures include blocking by MetaMask, PhishDestroy, and SEAL, further corroborating its malicious classification. The domain's Gridinsoft trust score of 0/100 provides quantitative confirmation of its fraudulent nature. Users who visited public-en-orca-swap.pages.dev should immediately revoke all connected wallet authorizations through their wallet software's permission manager. Any transactions signed while the site was active may have granted unauthorized access to funds. Affected parties should transfer remaining assets to new wallet addresses and monitor transaction histories for unexpected activity. Cryptocurrency exchanges and wallet providers should add this domain to their internal blocklists, while security teams should investigate potential connections to other Solana-based phishing campaigns. The domain's current offline status does not eliminate risk, as phishing infrastructure often reemerges under different identifiers.