order-secure-pay[.]site

This domain is flagged as a high-risk credential harvesting infrastructure specifically designed to impersonate MetaMask, a widely used cryptocurrency wallet service. The site targets users by mimicking legitimate authentication portals, tricking victims into submitting sensitive wallet credentials, recovery phrases, or private keys under the guise of security verification or transaction confirmation processes. Such attacks pose severe financial and operational risks, including unauthorized asset transfers and complete account compromise. Analysis indicates the domain order-secure-pay.site was registered through a major domain registrar on May 21, 2026, with an SSL certificate issued by a widely trusted certificate authority. It currently resolves to IP address 76.223.105.230, hosted on a global content delivery network, which is consistent with infrastructure used to evade geofencing and enhance availability. VirusTotal detection shows 1 out of 95 security vendors have flagged this domain as malicious. The domain appears on three security blocklists, including those maintained by anti-phishing and brand protection entities. Despite its recent creation date, the site remains active and is blocked by multiple threat intelligence feeds, including those operated by the targeted brand and independent security researchers. Mitigation requires immediate action from network administrators, security teams, and end users. Network-level blocking of the domain and its resolving IP address (76.223.105.230) is recommended to prevent access. Security teams should monitor for connections to this infrastructure and investigate any internal systems that have interacted with it. End users should be educated to verify domain authenticity before entering credentials, particularly on sites requesting wallet access or recovery phrases. Multi-factor authentication and hardware-based key storage should be enforced where possible to reduce the impact of credential compromise. Organizations are advised to report the domain to relevant threat intelligence platforms to support broader detection and takedown efforts.