origindeffi[.]site

Analysis of origindeffi.site indicates a wallet/seed phishing threat that was taken offline prior to the report date of July 23, 2026. The domain was registered on February 21, 2026 through Web Commerce Communications Limited and uses the Cloudflare nameservers joyce.ns.cloudflare.com and morgan.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States. No SSL certificate is presented for the site, confirming the absence of HTTPS protection.

The page title returned by the server is "Origin," and the site lacks a trust score, receiving a zero rating from Gridinsoft. VirusTotal scans show that eight of ninety‑three security vendors flagged the domain, reinforcing the malicious assessment. The domain appears on two public blocklists and is actively blocked by PhishDestroy and ScamSniffer, both of which classify it as a wallet/seed phishing operation. The risk level is elevated, and the current status is offline, meaning the site is no longer reachable for end users.

Uncertainty remains regarding the exact content served before takedown, as no visual or functional analysis is available. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any re‑registration or similar aliases, and consider adding the IP address 188.114.97.3 to threat intelligence feeds. Ongoing observation of Cloudflare‑hosted infrastructure is advised, as the provider may host additional malicious assets under different subdomains. The combination of low trust score, multiple vendor detections, and inclusion on reputable blocklists provides sufficient evidence to treat origindeffi.site as a confirmed wallet/seed phishing source.