orca-swap[.]net

The domain orca-swap.net was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and first observed on June 06, 2026. Since its appearance, multiple threat‑intelligence feeds have classified it as a generic phishing infrastructure and have assigned an elevated risk rating. The site is currently listed as active in the internal database, and three independent blocklist operators—PhishDestroy, MetaMask, and SEAL—have added it to their deny lists. In addition, the domain appears on three broader security blocklists, indicating that at least a small consortium of anti‑phishing services has encountered malicious activity associated with it.

VirusTotal analysis shows that six out of ninety‑one scanning engines have returned a positive detection for the domain, reinforcing the suspicion that it hosts or redirects to malicious content. The exact nature of the payload, the hosting IP address, and SSL certificate details were not disclosed in the available intelligence, so those vectors remain unverified. Likewise, no page‑title, brand targeting, or specific phishing kit information has been published, limiting the ability to attribute the campaign to a particular threat actor or to describe the user‑experience presented on the site. Given the current evidence, defenders should treat any traffic to orca-swap.net as potentially hostile.

Recommendations include adding the domain to local deny lists, configuring web‑gateway filters to block HTTP and HTTPS requests, and monitoring DNS logs for look‑ups originating from internal hosts. Incident response teams should also correlate any authentication attempts or cryptocurrency wallet interactions that reference the domain with this indicator, as the involvement of MetaMask in the blocklist suggests a possible focus on crypto‑related phishing. Continuous re‑evaluation is advised, as further static or dynamic analysis may reveal additional artefacts such as command‑and‑control endpoints or credential‑harvesting forms.