apexorcapital[.]cfd

The domain apexorcapital.cfd was registered on February 22, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States). The site is protected by a Google Trust Services / WE1 SSL certificate, indicating that Cloudflare is terminating TLS for the domain. Both authoritative nameservers, ashton.ns.cloudflare.com and aron.ns.cloudflare.com, belong to Cloudflare’s DNS service. Passive scans detected Cloudflare Browser Insights, generic Cloudflare headers, and HTTP/3 support, confirming the use of Cloudflare’s edge network.

The only visible page element is a dynamically generated title that includes a long query string (apexorcapital.cfd/?v=33dc6&session=16782b10e4498f26422a9c2c2a37922c&ray=5b8f941d84f6d28e&ts=1771773593&geo=28&ver=7.8.7&jst=b8af50877820aea381c23523e3febf54), and the HTTP response returns a 404 status code, suggesting the page is no longer serving content. VirusTotal records show that three of ninety‑five scanning engines have flagged the domain, and it appears on a single security blocklist managed by PhishDestroy. The threat classification is brand impersonation, specifically targeting the Orca brand.

While the current offline status limits immediate exposure, the infrastructure choices—Cloudflare hosting, a valid SSL certificate, and a recent registration date—are consistent with typical abuse patterns used to lend legitimacy to counterfeit sites. Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the associated IP range, and include the domain in threat‑intel feeds. Because the site is presently returning 404, no further malicious payloads have been observed, but the presence of a brand‑impersonation tag and vendor detections indicates a high likelihood of prior or future malicious activity aimed at deceiving Orca users.