orionvpn[.]shop

The domain orionvpn.shop was registered on 2026-04-03 through Web Commerce Communication Ltd. It is hosted on IP 2.26.76.15, an address associated with Ace Data Centers II, LLC in the United States. DNS resolution uses Cloudflare name servers jillian.ns.cloudflare.com and yahir.ns.cloudflare.com. The site presents an HTTPS service using a Let’s Encrypt R12 certificate and returns HTTP 200 for the root URL. The page title observed is "VPN – Безопасный и быстрый VPN", indicating a claim of a secure and fast VPN service. Threat intelligence sources flag the domain as a high‑risk generic phishing infrastructure. AlienVault OTX references it in one pulse, and three of ninety‑four VirusTotal scanners have flagged it. Gridinsoft assigns a trust score of 0/100, and the domain appears on a single blocklist, currently blocked by PhishDestroy. The infrastructure is still active as of 2026-07-12. Evidence confirms the domain’s association with phishing‑related activity, but the specific payload or credential‑harvesting mechanisms have not been publicly disclosed. Consequently, the exact victim targeting and attack vector remain uncertain. Defenders should add orionvpn.shop to URL filtering and DNS block lists, monitor outbound traffic for connections to 2.26.76.15, and enforce TLS inspection to detect potential credential submission. Continuous telemetry from security appliances should be reviewed for any alerts referencing the domain or its certificate fingerprint. Organizations using VPN solutions should educate users about unsolicited VPN offers and verify legitimate service endpoints before entering credentials.