id[.]orijin[.]plus

This domain, id.orijin.plus, is identified as a generic phishing site designed to impersonate a legitimate product information portal. Analysis confirms the domain is currently offline, though prior activity involved luring users into disclosing sensitive data under the guise of product verification or updates. The threat type aligns with credential harvesting and potential malware distribution, targeting individuals seeking product-related services. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Amazon Registrar, Inc., and resolves to the IP address 13.226.244.115, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. The SSL certificate is issued by Amazon RSA 2048 M02, a common practice among legitimate services that threat actors exploit to appear trustworthy. The domain is flagged by 11 of 95 security vendors on VirusTotal, and it appears on one security blocklist, further corroborating its malicious intent. The page title, 'Product Info Page,' suggests an attempt to mimic a corporate or e-commerce portal, increasing the likelihood of successful social engineering. As of the latest assessment, id.orijin.plus has been taken offline, reducing immediate risk to end users. However, organizations and individuals should remain vigilant, as domains of this nature often reappear under similar names or infrastructure. Recommended actions include blocking the domain and its associated IP (13.226.244.115) at the network level, monitoring for related subdomains or typosquatting variants, and educating users on recognizing phishing attempts. Security teams should also review logs for prior connections to this domain and investigate any potential data exposure or unauthorized access attempts linked to its activity.