orca-wallet-auth[.]pages[.]dev

This domain represents a targeted brand impersonation campaign designed to deceive users of the Solana blockchain ecosystem. Analysis indicates the site mimics legitimate cryptocurrency wallet services, specifically the Orca protocol, to harvest sensitive credentials such as private keys, seed phrases, or wallet login details. The fraudulent infrastructure may also distribute crypto drainer malware, which automatically siphons funds from connected wallets without user authorization. The page title, 'Orca Wallet — Secure DeFi Gateway for Solana Users,' reinforces the deception by leveraging trusted branding to lower user vigilance. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain orca-wallet-auth.pages.dev was registered through Cloudflare, Inc. on April 30, 2026, a future date that suggests domain spoofing or incorrect registration metadata. It resolves to the IP address 188.114.97.3, hosted on Cloudflare infrastructure in California. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security. As of the latest assessment, the domain is flagged by 1 out of 95 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. These indicators, combined with the domain’s active status, confirm its ongoing operational threat. Users who have visited orca-wallet-auth.pages.dev should take immediate action to mitigate potential compromise. Disconnect any wallets linked to the site and revoke all connected dApp permissions via the official Solana wallet interface. Scan the device for malware using updated security tools, focusing on crypto-related threats. Monitor all associated wallet addresses for unauthorized transactions and transfer remaining assets to a new, secure wallet. Report the domain to relevant blockchain security platforms and avoid interacting with any communications or pop-ups originating from the site. Enhanced vigilance is advised, particularly when engaging with DeFi platforms or wallet services.