maison-orbey[.]de

This domain, maison-orbey.de, has been confirmed as a compromised web property exhibiting signs of unauthorized defacement and brand impersonation targeting WordPress. Analysis indicates the site was hijacked by a threat actor identified as MR.GREEN, whose signature appears in the page title. While no active phishing kit or credential harvester was detected, the defacement suggests prior compromise of the underlying infrastructure, potentially enabling future malicious redirection or secondary payload delivery. The domain’s association with WordPress impersonation aligns with common tactics used to exploit trust in widely adopted content management systems. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 62.116.165.148, hosted on autonomous system AS15456 (InterNetX GmbH) in Germany. Security vendors on VirusTotal flagged the domain in 17 out of 95 detection engines, indicating moderate consensus on its malicious status. The domain appears on three independent security blocklists, including entries in PhishDestroy, OpenPhish, and PhishingDB repositories. A Let’s Encrypt SSL certificate (serial R13) was issued for the domain, a common feature in both legitimate and malicious infrastructure. No registrar or creation date was provided in available telemetry, limiting temporal attribution. As of the latest assessment, maison-orbey.de has been taken offline, reducing immediate exposure to end users. However, residual risk persists due to the compromised nature of the infrastructure. Organizations should monitor for re-emergence under the same IP or autonomous system, particularly if the original compromise remains unpatched. Network defenders are advised to block the domain and associated IP at perimeter controls, while WordPress administrators should verify integrity of their installations and review access logs for unauthorized modifications. The defacement by MR.GREEN suggests a history of unauthorized access, warranting further investigation into the root cause of the breach.