ChainPatrol
Web-Check 
SOCRadar 
LeakIX 
MALICIOUS — CRITICAL
id.rivdevis.xyz - Orange Phishing Scam
id[.]
The domain id.rivdevis.xyz is linked to generic phishing with 16 of 95 VirusTotal vendors detecting it as malicious and appearing on one security blocklist.
95/100 evidence score · Critical
- VirusTotal
- 16/91
- Blocklists
- No stored match
- Availability
- Content unavailable · HTTP 502
Do not enter credentials, seed phrases, payment details, or personal information on this domain.
Jump to section
Evidence Analysis
The domain id.rivdevis.xyz is designed to deceive users by imitating the Orange brand, as indicated by its page title "Saisie de votre identifiant - Identification Orange." This domain has been identified as a phishing threat, with 16 out of 91 VirusTotal vendors flagging it as malicious. Despite its current offline status, the site was active long enough to pose a significant threat.
Registered through NETIM, the domain was hosted on IP 185.26.106.234 in France, under the organization Eurofiber France SAS. The SSL certificate was issued by Let's Encrypt, a common choice for phishing sites due to its free and automated nature. The domain was created on June 2, 2026, and PhishDestroy detected it on June 20, 2026, highlighting the importance of early detection in mitigating phishing risks.
The domain's platform risk score of 78 out of 100 underscores its potential threat level. It appears on one public blocklist, specifically PhishDestroy's, indicating proactive measures to protect users. The takedown of id.rivdevis.xyz reduces its immediate threat, but the incident serves as a reminder of the ongoing need for vigilance against phishing schemes. Phishing domains like this exploit the gap between registration and detection, emphasizing the need for real-time threat intelligence.
Stored source results
Recorded verdicts and infrastructure observations for this domain.
VirusTotal
16 det.
URLQuery
6 threat alerts
CF Radar
Malicious
URLScan
TLS Certificate
Let's Encrypt / YE2
Age
2 mo New
Observed status
Content unavailable 502
DestroyList
Listed
Reports Sent
1
Data coverage12 recorded checks
VirusTotal
16 / 91
URLQuery
6 threat-system alerts
PhishStats
not checked
OTX
no community references
CF Radar
provider verdict: malicious
URLScan capture
stored report
URLScan verdict
malicious
DNS blocks
not checked
TLS
valid certificate, 37d
WHOIS
2 mo old
Screenshot
3 captures · 3 sources
Redirect chain
not probed
Network Security Intelligence
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| DNS4EU | id.rivdevis.xyz |
malicious | Sinkholed |
| Cloudflare DNS | id.rivdevis.xyz |
malicious | Sinkholed |
| OpenDNS | id.rivdevis.xyz |
phishing | Phishing Block |
| Quad9 DNS | id.rivdevis.xyz |
malicious | Sinkholed |
| Cloudflare DNS | mail03-blocage-provisoire.abrdns.com |
malicious | Sinkholed |
| DigiCert UltraDNS | mail03-blocage-provisoire.abrdns.com |
malicious | Sinkholed |
Threat Response Pipeline
Discovery
Checks
Reports
Availability
15/15
Threat Ingested
id.rivdevis.xyz detected and queued for full analysis
URLScan.io Capture
Stored URLScan report with capture artifacts
URLScan Verdict
URLScan returned a malicious verdict · score 100
Cloudflare Radar Report
A stored Cloudflare Radar report is available. The report link alone is not a malicious verdict and does not prove that every network field was captured.
VirusTotal
16/91 recorded on VirusTotal
Google Safe Browsing
Checked via Google Transparency Report
CF Radar: Malicious
Cloudflare Radar classified this domain as phishing
Brand Impersonation
Impersonation of Orange
Forensic Evidence Collected
Stored evidence from URLScan.io, URLQuery, stored screenshot
Technical Analysis Recorded
The report contains stored technology or forensic-analysis results.
Cloudflare Radar Scan
Scanned with Cloudflare Radar; network analysis completed.
Sent Report Recorded
Stored sent-report record for registrar NETIM, hosting provider, 1 abuse contact
abuse@netim.net
DestroyList Published
Listed in the public PhishDestroy/DestroyList repository
Content Observed Unavailable
The latest stored checks indicate that the reported content is unavailable; this does not establish who or what caused the change.
Time to First Unavailability
26 hours elapsed from detection to the first unavailable observation.
Public Blocklist Status
Stored Capture
Domain Intelligence
Domain
URLScan Verdict
Malicious
score 100 Phishing brand: Orange report ↗
Server / ASN
Apache · AS8075 MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US
IP Reputation
abuse score 0/100 0 reports checked Jun 20, 2026
Registrar (base domain)
NETIM
(FR)
(FR)
IP Address
4.222.186.43
Registration (base domain)rivdevis.xyz · Created Jun 2, 2026 (68d · New) — Expires Jun 2, 2027
HTTP Status502 Error
Technical detailsDNS, SSL SANs, timestamps
First DetectedJun 20, 2026
DOM Analysisanalyzed Jun 20, 2026score 88/100
IoC Extractionscanned Jul 29, 20260 wallet · 0 Telegram IoCs
Submitted URLhttp://id.rivdevis.xyz/
Nameserversns1.netim.netns2.netim.netns3.netim.net
TLS Fingerprint
TLS Observationvalid from Jun 18, 2026scanned Jun 20, 2026
Case ID
ICANN OVERSIGHT
Registration: rivdevis.xyz
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For the registrable domain rivdevis.xyz behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Accreditation is a contract, not a safety seal.
Verify ICANN fees
Read RAA §3.18
PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight
Technologies · 1 identified
A
Apache HTTP Server
Web servers
Apache is a free and open-source cross-platform web server software.
httpd.apache.org 100% confidence
Detected via Cloudflare Radar · Wappalyzer engine
Report This Domain
Submit evidence & help protect others
VirusTotal Analysis
16 / 91 security vendors flagged this domain
View on VT
Last analyzed Previous stored snapshot: 16 detections
alphaMountain.ai
BitDefender
CRDF
ESET
Emsisoft
Forcepoint ThreatSeeker
Fortinet
G-Data
Gridinsoft
Kaspersky
LevelBlue
Lionic
Netcraft
OpenPhish
Sophos
Webroot
Evidence & External ReportsIndependent lookups and source reports
Security Analysis
Submitted Evidence Snapshot
Sent: Ledger records: 1
Case ID:
PD-20260620-F6F6D8 Recipient: abuse@netim.net Page title stored with report: New Private Tab
OSINT & Intelligence
DNS & Network
SEO & Domain
Victim safety and official reportingImmediate actions and verified reporting channels
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Action Fraud
Report fraud and cybercrime in England, Wales and Northern Ireland
Contact centre0300 123 2040
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
97-country directory
Template-based draft • optional AI wording assistance requires separate consent
Review and submit it yourself
Related Infrastructure & ReportsStored relationships and adjacent records
Content matches 4
Same registrar: NETIM 6
humidi.fi 
rainbet-casinos.eu 
primeedgefx.com 
netabogados.click 
Orange impersonation 8
These domains also target Orange users. View all Orange threats →
Recent threat reports 4
Recently added threat reports.