ore-supply[.]info

PhishDestroy identifies the domain ore-supply.info as an active participant in a generic phishing campaign, currently under investigation with a status marked as active. No specific brand impersonation has been confirmed at this time, but the threat type remains classified as generic_phishing pending further analysis.

This domain was flagged by 10 of 95 VirusTotal security vendors as of the latest scan, indicating a lack of immediate detection despite malicious activity. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, resolving to the IP address 104.21.22.207. The domain was created on March 12, 2026, and currently operates with a Let's Encrypt SSL certificate, adding a veneer of legitimacy to any hosted content. As of this advisory, ore-supply.info has not been identified on any public blocklists, though its recent creation and low detection rate suggest a high potential for evading early-stage scrutiny.

Due to the active status and generic nature of the phishing threat posed by ore-supply.info, users and organizations are strongly advised to implement immediate countermeasures. Block network traffic to the domain at the firewall or DNS level to prevent access. Additionally, inspect internal systems for any communications referencing this domain, particularly emails, web requests, or downloads. Given the low detection rate among security vendors, exercise heightened vigilance for phishing attempts mimicking legitimate supply chain or procurement communications. Security teams should monitor this domain for updates and adjust threat intelligence feeds accordingly. No direct remediation is required for end-users beyond avoidance, but proactive threat hunting is recommended to identify related malicious infrastructure.