bogus-orange[.]pro

On July 23, 2026 analysis of bogus-orange.pro shows the domain is currently offline, returning HTTP 404 with a page title of “403”. The host resolves to 88.85.94.240, an address owned by Webzilla B.V. in the Netherlands and announced under ASN 35415. The server is identified as Nginx and presents a Let’s Encrypt certificate (issuer E8), indicating recent TLS provisioning. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 / 100, the domain appears on a single security blocklist, and PhishDestroy has explicitly blocked it.

VirusTotal reports that 16 of 95 scanned scanners flagged the host, while AlienVault OTX lists the domain in 17 separate threat‑intel pulses. The four UltraDNS name servers (pdns73.ultradns.com, .biz, .co.uk, .in) are typical of fast‑fluctuating malicious infrastructure. The combination of a low‑trust score, multiple vendor detections, and active blocklist entries confirms the site’s use for generic phishing campaigns, despite the lack of a publicly observable landing page. Because the site is offline, content analysis is unavailable; the page title “403” suggests an intentional denial response, but no further indicators of the targeted brand or credential‑stealing template can be extracted.

Defenders should continue to block the domain at perimeter filters, add the IP 88.85.94.240 to deny lists, and monitor the associated ASN for new host registrations. Threat‑intel teams are advised to correlate the 17 OTX pulses with other observed phishing infrastructure to identify possible campaign overlaps. Ongoing surveillance of the UltraDNS name servers may reveal re‑hosting attempts, and periodic rescans of the domain should be scheduled in case it returns to service.