orbix-finance[.]com

This domain is flagged as an elevated-risk credential theft operation designed to harvest sensitive user login data, financial details, or personal information through deceptive interfaces. Analysis indicates the site impersonates legitimate financial platforms to trick users into entering credentials, which are then exfiltrated to attacker-controlled infrastructure. The threat type aligns with credential harvesting rather than generic phishing, as evidenced by its targeted design and rapid takedown following detection. Infrastructure analysis reveals multiple high-risk indicators. The domain orbix-finance.com resolves to IP address 198.12.80.250, hosted on AS36352 (HostPapa) in the United States. It was registered on April 26, 2025, through Sav.com, LLC, with a Let's Encrypt SSL certificate (R13) that, while encrypted, does not validate legitimacy. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, and it appears on at least one security blocklist. The domain's creation date suggests a short operational window, typical of disposable phishing infrastructure. To mitigate credential theft risks, users should avoid interacting with the domain entirely. If credentials were entered, immediate password resets are required across all platforms where identical or similar passwords were used. Organizations should block the domain and its resolving IP at the network perimeter, monitor for related IOCs (e.g., 198.12.80.250, orbix-finance.com), and educate users on recognizing deceptive financial login pages. SSL certificates from Let's Encrypt or other providers should not be trusted as sole indicators of legitimacy, as they are frequently abused in credential theft campaigns.