orbiter-5xf[.]pages[.]dev

This domain orbiter-5xf.pages.dev is currently active and hosts a page titled “Prizes” that is linked to a fake‑airdrop lure. The domain was registered on 29 March 2026 through a widely used DNS provider and resolves to the IP address 172.66.44.107, which is associated with infrastructure located in California. The site presents a valid TLS certificate from a recognized certificate authority, enforces HTTP Strict Transport Security, and delivers content over the latest HTTP version. Front‑end analysis shows the use of a contemporary JavaScript framework and embedded analytics code, indicating a typical modern web stack. The domain appears on at least one public blocklist, has been flagged by an anti‑phishing feed, and receives a zero‑score from a reputation engine, all of which support a malicious classification. No deeper content inspection is available beyond the page title, so the exact mechanics of credential capture or redirection remain unknown. Defenders should add orbiter-5xf.pages.dev to URL filtering and DNS block lists, monitor for outbound connections to the associated IP and its hosting provider, and watch for any related activity that may indicate escalation of the campaign. Ongoing surveillance is advised to detect potential changes in payload or additional infrastructure.