oresupplypool[.]live

Analysis of the domain oresupplypool.live indicates it is actively involved in an investment scam as of July 12, 2026. The domain resolves to IP address 172.67.204.117, hosted on Cloudflare's infrastructure (AS13335) in the United States. It is registered through Cloudflare, Inc., and employs Cloudflare technologies, including HTTP/3, alongside a Google Trust Services SSL certificate (WE1). Current HTTP responses return a 403 status with the page title 'Just a moment...', suggesting either a holding page or access restrictions to evade detection. The domain appears on one security blocklist and has been referenced in two threat intelligence pulses on AlienVault OTX, reinforcing its association with malicious activity. While three out of 95 security vendors on VirusTotal flag the domain, the exact nature of the scam content remains unconfirmed due to the lack of accessible page details. The investment scam classification is based on existing threat intelligence, though no specific brand impersonation or detailed fraud mechanics are currently documented. Defenders are advised to treat this domain as high-risk infrastructure. Blocking the domain and its resolving IP at network and endpoint levels is recommended. Monitoring for related domains using similar naming patterns or Cloudflare-hosted infrastructure may help identify additional threats. Further analysis of the site's content, if accessible, could provide additional indicators of compromise or victim targeting tactics.