orbicapital[.]com

This domain is flagged for elevated-risk phishing activity specifically targeting users of Orbis Investment. Analysis indicates the site mimics legitimate financial services login portals to harvest credentials, a tactic consistent with brand impersonation schemes. The domain exhibits no legitimate financial service affiliation and operates solely for malicious credential theft. Infrastructure analysis reveals orbicapital.com was registered through GoDaddy.com, LLC on April 12, 2026, an anomalous creation date suggesting potential domain spoofing. The domain resolves to IP address 135.125.128.106 and is detected by 6 out of 95 security vendors on VirusTotal. It appears on one security blocklist and holds a Gridinsoft trust score of 0/100. Technologies detected include Vue.js for frontend interactivity, Nginx as the web server, and HSTS implementation, which may be exploited to lend false legitimacy. The page title, 'Orbis Investment,' directly mirrors the legitimate brand to deceive targets. Mitigation requires immediate blocking of the domain and its associated IP (135.125.128.106) at network perimeter controls. Organizations should deploy indicators of compromise (IOCs) including the domain, IP, and page title into security monitoring systems to detect related phishing attempts. Users who accessed the site must reset credentials through verified Orbis Investment channels, enable multi-factor authentication, and review accounts for unauthorized activity. Security teams should conduct retrospective log analysis for connections to 135.125.128.106 or requests to orbicapital.com within the past 30 days to identify potential breaches.