orenji[.]boo

This domain is flagged for hosting a credential-harvesting phishing operation targeting unsuspecting users through fake login portals. Analysis indicates the infrastructure is designed to impersonate legitimate services, tricking victims into submitting sensitive authentication details. The risk level is classified as elevated due to the domain's active exploitation history and technical obfuscation measures. Infrastructure analysis reveals the domain orenji.boo resolves to the IP address 104.21.52.170 and was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com. It employs WordPress, MySQL, PHP, and Cloudflare Browser Insights, with HTTP/3 support for performance optimization. The SSL certificate is issued by Google Trust Services, while security vendors on VirusTotal flagged it at a 3/95 detection ratio. Gridinsoft assigned a trust score of 0/100, and the domain appears on one security blocklist, specifically PhishDestroy. The page title, 'Orenji,' suggests a thematic or branding element used to lend false legitimacy. Mitigation requires immediate blocking of the domain and its resolving IP (104.21.52.170) at the network perimeter. Organizations should deploy email and web filtering rules to prevent user access, particularly to URLs mimicking login pages. Endpoint protection should be configured to detect and quarantine phishing-related artifacts, such as embedded forms or scripts. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window. Monitoring for secondary infections or follow-up attacks, such as malware delivery or session hijacking, is recommended.