orbitalpay[.]icu

Analysis of orbitalpay.icu indicates an active, high‑risk generic phishing infrastructure. The domain was registered on February 21, 2026 through NameSilo, LLC and is hosted behind Cloudflare (nameservers ruben.ns.cloudflare.com and dell.ns.cloudflare.com, AS13335). DNS resolution points to IP 172.67.141.150, which is located in the United States and served by Cloudflare’s edge network with HTTP/3 enabled. The site presents a HTTP 403 response and the page title returned is "Just a moment...", suggesting a Cloudflare challenge page rather than the final payload. SSL termination uses a Google Trust Services certificate (WE1), confirming a valid TLS chain. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 / 100, the domain appears on one security blocklist, and PhishDestroy has listed it as blocked. AlienVault OTX references the domain in a single threat pulse, and VirusTotal reports detections by seven of ninety‑three scanned scanners. The limited public intelligence does not reveal the exact phishing landing page or target brand, and no sample payload has been observed. Defenders should block the domain and its resolving IP at perimeter filters, monitor for outbound connections to the Cloudflare edge, and add the domain to internal threat intel feeds. Ongoing observation is advised to capture any future content changes that may disclose the credential‑harvesting vector.