orxglobal[.]com

orxglobal.com is currently active and classified as a generic_phishing site with a high risk rating. The domain was registered on March 11, 2026 through Dynadot LLC and resolves to IP 159.100.9.49, which is hosted in Germany under ASN 214036 (Ultahost, Inc.). DNS resolution uses Cloudflare nameservers evelyn.ns.cloudflare.com and quincy.ns.cloudflare.com. The web server presents an HTTP 302 redirect and serves a TLS certificate from Let’s Encrypt (R12). Technology fingerprinting shows Nginx as the web server, with front‑end assets built on Tailwind CSS, Slick, jsDelivr, and jQuery libraries, and HSTS is enabled. The page title returned by the server is “On-chain Recovery eXperts | orxglobal.com”, suggesting a focus on cryptocurrency recovery services, a common lure in phishing campaigns. Gridinsoft assigns a trust score of 1 out of 100, and VirusTotal reports a single positive detection out of 95 scanners. The domain appears on one external blocklist and has already been blocked by the PhishDestroy sinkhole. Despite these indicators, the exact content of the site has not been examined, so the specific phishing vector remains unknown. Defenders should treat any traffic to or from this domain as malicious: block the domain at DNS or proxy level, add the IP address 159.100.9.49 to network deny lists, and monitor for outbound connections to the host. Continuous scanning of the domain for changes in page content or additional malicious payloads is recommended, as is updating internal threat intel feeds with the observed indicators.