orbiterfinanceapp[.]live

Analysis indicates that the domain orbiterfinanceapp.live is currently offline but exhibits multiple indicators consistent with a brand‑impersonation operation targeting the Orbiter Finance brand. The site was hosted behind Cloudflare, Inc., using the nameservers gina.ns.cloudflare.com and john.ns.cloudflare.com, and resolved to the IP address 104.21.74.138, which belongs to Cloudflare’s AS13335 network in the United States. No TLS certificate was presented, meaning the site did not serve HTTPS traffic, a common characteristic of hastily deployed malicious pages. The page title returned by HTTP requests was “Orbiter Finance - Revolutionizing Crypto Transactions,” directly referencing the legitimate brand and suggesting an attempt to deceive users.

Reputation services have flagged the domain. It appears on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score is 0 / 100, indicating a severe lack of credibility. VirusTotal reports that the domain was scanned by 95 vendors, none of which raised a detection at the time of analysis; however, the absence of detections does not constitute evidence of safety.

The combination of brand‑related page title, lack of encryption, Cloudflare‑only hosting, and multiple blocklist entries aligns with known patterns of brand‑impersonation campaigns that lure victims into providing credentials or cryptocurrency wallet information. Uncertainty remains regarding the exact payload or phishing page content because the site is offline and no further technical artefacts have been disclosed. Defensive operators should continue to block the domain at network perimeter and DNS layers, monitor for any re‑appearance of the same hostname or associated IP address, and consider adding the host to internal watchlists. Users should be warned that any unsolicited communication referencing Orbiter Finance that directs them to a “orbiterfinanceapp.live” URL is likely fraudulent.