orvexara-portal[.]com

The domain orvexara-portal.com was registered through Dynadot Inc on 13 April 2026. It resolves to the Cloudflare‑owned address 172.67.178.108, which is geolocated to Canada and is served behind Cloudflare’s edge network. The site presented the page title “ORTEX” and employed a TLS certificate issued by Let’s Encrypt (certificate identifier E7). Technical fingerprinting shows the use of Vue.js, HTTP/3, HSTS enforcement, Cloudflare Browser Insights, and the generic Cloudflare reverse‑proxy stack. The domain’s authoritative nameservers are amy.ns.cloudflare.com and bob.ns.cloudflare.com.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely malicious profile. Detection data indicate that 20 of 94 security vendors on VirusTotal flag the domain as malicious, and it appears on three public blocklists. Additional protective services—PhishDestroy, MetaMask, and SEAL—have explicitly blocked the domain. The threat is classified as brand impersonation targeting Microsoft, with the overall risk rating set to high. As of the report date (23 July 2026) the domain is reported offline, suggesting that the malicious infrastructure has been taken down or is temporarily inactive.

Analysts should continue to monitor the IP address 172.67.178.108 for any re‑activation and ensure that outbound traffic to this host is denied at the network perimeter. The associated nameservers should be added to DNS‑based blocklists, and any observed attempts to resolve or contact the domain should be logged and investigated. Given the low trust score, the presence on multiple blocklists, and the confirmed brand‑impersonation intent, security teams are advised to treat any residual artifacts—such as cached URLs, email links, or client‑side redirects—to this domain as malicious and to quarantine or delete them. Ongoing threat‑intel feeds should be consulted for potential reuse of the same infrastructure in future campaigns.