orangex-login[.]at

Analysis as of July 27 2026 indicates that the domain orangex-login.at is actively serving content and returns HTTP 200 responses, suggesting an operational web server. VirusTotal records show that six of ninety‑one security vendors have flagged the domain, providing independent confirmation of malicious activity. The domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its designation as a credential‑phishing infrastructure. The threat type is identified as credential phishing and the risk level is high, reflecting the potential for credential harvesting.

No further intelligence such as registrar details, registration date, hosting IP address, autonomous system number, SSL certificate data, or page title has been disclosed, leaving those infrastructure components unverified at this time. Consequently, the full scope of the hosting environment and any possible fast‑flux or CDN usage remain uncertain. Defensive recommendations include adding orangex-login.at to internal blocklists, ensuring that DNS filtering solutions deny resolution, and configuring web proxies to drop HTTP 200 traffic destined for the host.

Network monitoring should flag outbound connections to the domain, and security information and event management (SIEM) rules should be tuned to generate alerts on any flow toward the address. Because the domain remains active, continuous surveillance is advised to detect any changes in detection counts, additional blocklist listings, or new hosting attributes. The limited detection footprint—six vendor flags and a single blocklist entry—highlights the need for proactive inclusion in defensive controls rather than reliance on broader vendor feeds alone.