auth-orca-dexx-io[.]pages[.]dev

Analysis of auth-orca-dexx-io.pages.dev indicates that the domain was registered on February 21, 2026 through Cloudflare, Inc. and is currently hosted on Cloudflare infrastructure (AS13335) with the IP address 172.66.47.55 located in the United States. The site presents a Cloudflare-generated page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that the content has been taken offline. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS configuration despite the malicious attribution. Security telemetry shows the domain appears on three blocklists, specifically PhishDestroy, MetaMask, and SEAL, and three separate security vendors on VirusTotal have flagged it, reinforcing the malicious classification.

Gridinsoft assigns a trust score of 0 out of 100, and the domain is marked as a credential phishing campaign in the supplied intelligence. Detected technologies include HTTP/3, HSTS, and Cloudflare services, all consistent with the hosting provider’s default stack. The elevated risk rating reflects the combination of recent creation, low trust score, blocklist presence, and vendor detections.

Defenders should add auth-orca-dexx-io.pages.dev to URL filtering and sinkhole lists, enforce DNS blocking at the enterprise level, and monitor Cloudflare DNS changes for potential re‑hosting. Continuous observation of VirusTotal and other sandbox feeds is advised to capture any re‑appearance or new payloads associated with this domain. Given the current offline status, remediation focus should remain on preventing user interaction and ensuring that downstream security controls recognize the domain as malicious.