join-us-orca-swapp[.]pages[.]dev

This domain, join-us-orca-swapp.pages.dev, is under investigation for brand impersonation targeting Orca, a Solana-based decentralized finance platform. Registered on April 30, 2026, through Cloudflare, Inc., the domain remains active as of July 12, 2026. Infrastructure analysis reveals it resolves to IP address 172.66.47.103 and utilizes Cloudflare hosting services, including HSTS and HTTP/3 protocols. The SSL certificate is issued by Google Trust Services, a common configuration for both legitimate and malicious domains. The page title, 'Orca Swap – Swap, Trade, and Earn with Solana DeFi,' directly mirrors the branding and service description of the legitimate Orca platform, indicating a likely attempt to deceive users familiar with Orca’s offerings. The domain appears on one security blocklist (PhishDestroy) and has been assigned a trust score of 0/100 by Gridinsoft, suggesting potential malicious intent. No vendor detections were reported at the time of analysis, though this does not confirm the domain’s safety. Defenders should treat this domain as high-risk due to its recent registration, direct brand impersonation, and presence on a security blocklist. Network-level blocking or monitoring of the IP address 172.66.47.103 is recommended. Further investigation into user interactions with this domain is advised to determine the full scope of its activity. The exact content and functionality of the site remain unanalyzed, and no specific scam mechanism (e.g., credential harvesting, token drainer) has been confirmed.