orraprintpack[.]com

The domain orraprintpack.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting the x.com brand. Infrastructure analysis shows the domain resolves to IP 172.67.152.176, which belongs to AS13335 Cloudflare, Inc., and is located in the United States. The authoritative nameservers are beth.ns.cloudflare.com and curt.ns.cloudflare.com, indicating that the site is being fronted by Cloudflare’s CDN and edge services. TLS termination is performed using a certificate issued by Google Trust Services under the WE1 trust root, confirming that HTTPS connections are encrypted and that the certificate chain is valid. An HTTP request returns a 200 status code and the page title "Welcome to nginx!", suggesting the underlying web server is nginx but providing no additional content details.

Detected client‑side libraries include Bootstrap, OWL Carousel, Modernizr, and jQuery, and the service supports HTTP/3, all of which are common in modern web stacks but do not reveal malicious functionality on their own. Threat intelligence sources flag the domain as malicious: Gridinsoft assigns a trust score of 1 / 100, one security blocklist lists the domain, and AlienVault OTX references it in fourteen separate pulses. VirusTotal analysis shows thirteen of ninety‑three scanning engines have flagged the site, reinforcing the suspicion of malicious activity. The domain was registered through GoDaddy.com, LLC on July 28 2018, and has been explicitly blocked by the PhishDestroy blocklist. While the page title and server banner are the only visible artifacts, the convergence of a low trust score, multiple threat‑intel mentions, and active blocklisting indicates a credible impersonation effort.

Defenders should block or sinkhole the domain at network perimeter devices, update DNS filtering policies, and monitor for any outbound connections to the hosting IP. Additional scrutiny of any traffic claiming to originate from x.