originworld[.]org

This domain, originworld.org, is currently active and classified as a high‑risk generic phishing site. The domain was registered on February 21, 2026 through NameCheap, Inc., and its authoritative nameservers are coco.bunny.net and kiki.bunny.net. DNS resolution returns the IPv4 address 185.111.111.154, which is assigned to AS212238 Datacamp Limited and geolocated to Germany. An HTTPS connection is available using a Let’s Encrypt certificate (R13), and the web server responds with HTTP status 200.

The page title reported by the scanner is “Home | ORIGIN Protocol”, indicating that the site may be attempting to imitate a legitimate service, although the content of the page has not been analysed. Technology fingerprinting identifies a Node.js runtime with Vue.js and Nuxt.js frameworks, hosted on the Bunny platform. Email services are pointed at smtp.google.com with MX priority 1, suggesting that the attacker may be leveraging a reputable mail host for credential harvesting. The domain appears on a single security blocklist and is actively blocked by PhishDestroy.

VirusTotal analysis shows that one out of ninety‑three scanning engines has flagged the domain, providing an additional indicator of malicious intent. Current intelligence does not reveal any additional hosting changes, redirection behavior, or compromised accounts associated with the site. Defenders should block network connections to 185.111.111.154, add originworld.org to URL filtering policies, and monitor for any outbound traffic to the identified MX host. Continuous re‑scanning is recommended to detect possible changes in the site’s payload or additional vendor detections.