id[.]rivdevis[.]xyz

The domain id.rivdevis.xyz is designed to deceive users by imitating the Orange brand, as indicated by its page title "Saisie de votre identifiant - Identification Orange." This domain has been identified as a phishing threat, with 16 out of 91 VirusTotal vendors flagging it as malicious. Despite its current offline status, the site was active long enough to pose a significant threat.

Registered through NETIM, the domain was hosted on IP 185.26.106.234 in France, under the organization Eurofiber France SAS. The SSL certificate was issued by Let's Encrypt, a common choice for phishing sites due to its free and automated nature. The domain was created on June 2, 2026, and PhishDestroy detected it on June 20, 2026, highlighting the importance of early detection in mitigating phishing risks.

The domain's platform risk score of 78 out of 100 underscores its potential threat level. It appears on one public blocklist, specifically PhishDestroy's, indicating proactive measures to protect users. The takedown of id.rivdevis.xyz reduces its immediate threat, but the incident serves as a reminder of the ongoing need for vigilance against phishing schemes. Phishing domains like this exploit the gap between registration and detection, emphasizing the need for real-time threat intelligence.