orangerosehamburg[.]com

The domain orangerosehamburg.com was registered on 21 Feb 2026 through Web Commerce Communications Limited and is hosted behind Cloudflare (AS13335) with the IP 104.21.73.79 located in the United States. The site resolves to a Cloudflare‑provided SSL certificate issued by Google Trust Services (WE1) and serves HTTP/3 traffic. DNS resolution uses the nameservers celine.ns.cloudflare.com and jonah.ns.cloudflare.com. The only publicly visible page returns HTTP 403 and carries the title “TRX Bandwidth • Instant Network Resources”, which does not reference the targeted brand. Threat intelligence flags the domain as a fake exchange impersonating the Base platform. Gridinsoft assigns a trust score of 0 / 100, and seven of ninety‑three VirusTotal scanners have raised detections. The domain appears on three external blocklists and is listed in one AlienVault OTX pulse. It is also blocked by PhishDestroy, MetaMask, and SEAL. Current status is active. Analysis indicates that the infrastructure is typical of fast‑flux phishing operations that leverage Cloudflare for anonymity and rapid deployment. The mismatch between the page title and the claimed impersonation suggests a credential‑harvesting front‑end that may redirect or serve additional payloads after the initial request. No further content has been captured, so the exact phishing workflow remains unknown. Defenders should add orangerosehamburg.com to URL and DNS blocklists, monitor for connections to 104.21.73.79, and enforce TLS inspection to detect any hidden redirects. Continuous observation of new domains registered through the same registrar and similar Cloudflare name‑server patterns is recommended to pre‑empt related campaigns.