# PhishDestroy domain threat record: duplicate-disabled-46613.invalid

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/duplicate-disabled-46613.invalid/
Machine-readable companion: https://phishdestroy.io/domain/duplicate-disabled-46613.invalid/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-01-05 05:59:34 UTC
- Last availability or vendor check: 2026-10-21 01:16:29 UTC
- Stored record updated: 2026-10-22 14:22:01 UTC
- VirusTotal detections in the stored snapshot: 11/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: across

## Stored infrastructure

- Observed IP address: 45.10.243.7
- Registrar in stored WHOIS data: Ddos-guard

## Evidence links

- URLScan report: https://urlscan.io/result/019b8cf3-cadb-71f4-a4d5-aaa2896e7804/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/duplicate-disabled-46613.invalid
- Certificate Transparency search: https://crt.sh/?q=%25.duplicate-disabled-46613.invalid
- Web Archive lookup: https://web.archive.org/web/*/https://duplicate-disabled-46613.invalid/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

{"en": "Analysis of the domain www.orangex-login.at indicates active brand impersonation targeting cryptocurrency exchange users. The domain resolves to IP address 45.10.243.7 and is registered through DDoS-Guard, a provider frequently associated with bulletproof hosting services. Security vendors have flagged this domain, with four out of 95 detecting it as malicious, and it appears on two security blocklists, including PhishDestroy and BLP-Malware. The page title, 'OrangeX Login - Secure Cryptocurrency Exchange | OrangeX Exchange,' suggests an attempt to mimic a legitimate cryptocurrency trading platform, though the exact content and functionality of the site remain unverified.  Infrastructure analysis reveals the use of jQuery and Hammer.js, common frontend libraries, alongside DDoS-Guard’s protective services, which may obscure the true hosting origin. The SSL certificate is issued by Let’s Encrypt, a standard practice even among malicious domains to appear legitimate. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. Threat intelligence platforms, including AlienVault OTX, have included this domain in two pulses, reinforcing its classification as a confirmed threat.  Defenders should treat this domain as an active phishing risk, particularly for users of cryptocurrency services. Network-level blocking is recommended, along with monitoring for related indicators of compromise, such as the associated IP address. Further investigation into the domain’s backend infrastructure and potential ties to broader phishing campaigns is advised, though no additional technical details are currently available.", "tr": "Sure, I can help with that. What should I generate?"}
Analysis generated: 2026-07-12 23:09:21 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019b8cf3-cadb-71f4-a4d5-aaa2896e7804.png
  Captured: 2026-02-23 07:38:11 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019b8cf3-cadb-71f4-a4d5-aaa2896e7804.png
  Captured: 2026-02-23 07:38:11 UTC
  Source report: https://urlscan.io/result/019b8cf3-cadb-71f4-a4d5-aaa2896e7804/