start-orca-exchage-us[.]pages[.]dev

Analysis as of July 23 2026 indicates the domain start-orca-exchage-us.pages.dev is associated with a credential phishing campaign. The site was created on February 21 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers nolan.ns.cloudflare.com and crystal.ns.cloudflare.com. DNS resolution points to IP address 172.66.44.241, which belongs to AS13335 Cloudflare, Inc. in the United States. The HTTPS certificate presented is issued by Google Trust Services under the WE1 label, and the server advertises HSTS and HTTP/3, consistent with Cloudflare’s edge infrastructure. An HTTP 403 response is returned together with the page title “Suspected phishing site | Cloudflare”, confirming that Cloudflare has taken the content offline.

Security telemetry shows the domain appears on three blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100. VirusTotal analysis records three detections out of ninety‑one scanners, reinforcing the malicious classification. The available intelligence categorizes the activity as credential phishing, but no further payload or target details are disclosed. Defenders should immediately add start-orca-exchage-us.pages.dev to network deny lists and email URL filtering rules.

Because the domain resolves to Cloudflare infrastructure, consider applying domain‑level blocking at the DNS resolver to avoid future re‑hosting attempts. Monitoring of the associated IP 172.66.44.241 for any changes in status or additional malicious signatures is advised. Incorporating the domain into threat‑intel feeds and sharing the indicator with partners can improve collective detection. Given the low trust score and existing blocklist entries, the risk posture remains elevated until the indicator is fully mitigated.