stains[.]oridash[.]fr

Analysis indicates that stains.oridash.fr is an active phishing infrastructure targeting users of the Oridash service. The domain was registered through OVH on November 07, 2020 and continues to resolve to the IPv4 address 145.239.37.162, which is hosted in France under ASN16276 (OVH SAS). DNS resolution is served by the OVH nameservers dns113.ovh.net and ns113.ovh.net. The site presents a HTTP 302 redirect and serves a TLS certificate issued by Let’s Encrypt (certificate identifier E7), confirming the use of a legitimate certificate authority to appear trustworthy.

The page title returned from the web server is "Connectez-vous pour continuer – Oridash", matching the expected login prompt for the legitimate service and reinforcing the impersonation attempt. Multiple security tools have flagged the domain: thirteen of ninety‑five VirusTotal scanners reported malicious activity, and the domain appears on one public blocklist. Independent reputation services have assigned a Gridinsoft trust score of 0 out of 100, effectively marking the site as completely untrusted. Additionally, the anti‑phishing platform PhishDestroy has listed the domain as blocked, providing further confirmation of its malicious nature.

Given the observed indicators—active status, OVH hosting, Let’s Encrypt TLS, HTTP 302 redirection, low trust score, and multiple vendor detections—defenders should treat stains.oridash.fr as a high‑risk phishing host. Recommended mitigation steps include adding the domain and its resolving IP address to network‑level blocklists, updating email and web filtering rules to deny connections, and monitoring for any related C2 activity originating from the OVH infrastructure. Continuous re‑evaluation is advised, as the current evidence does not reveal the full scope of the credential‑stealing campaign, but the existing data strongly supports immediate containment.