order4923[.]icu

The domain order4923.icu was observed hosting a page whose title is "Just a moment…". The site resolves to the Cloudflare‑owned address 104.21.56.227, which belongs to ASN 13335 and is geolocated in the United States. Both authoritative name servers listed for the zone – deb.ns.cloudflare.com and johnny.ns.cloudflare.com – are Cloudflare‑managed, indicating the domain is being served through Cloudflare’s reverse‑proxy infrastructure. Registration data shows the domain was created on 21 February 2026 and was purchased through NiceNIC International Group Co., Limited; no SSL/TLS certificate is presented, so the site is reachable only over plain HTTP.

Seven of ninety‑three VirusTotal scanners have flagged the domain as malicious, and it appears on a single public blocklist that is referenced by the PhishDestroy service, which has already taken the site offline. The lack of a certificate, combined with the generic "Just a moment…" title, suggests the page is intended to act as an interstitial or redirect rather than a fully rendered phishing login. No additional indicators such as known brand names, credential‑capture forms, or malicious payload URLs have been disclosed, so the exact phishing lure remains undefined.

Defenders should continue to block the resolved IP address 104.21.56.227 for any traffic matching the order4923.icu hostname, enforce HTTPS‑only policies where possible, and monitor Cloudflare‑originated traffic for similar short‑lived domains. Threat‑intelligence feeds that reference the domain’s registration details, name‑server configuration, and the VirusTotal detection count can be used to enrich detection rules. Because the site is already offline, ongoing observation of the hosting infrastructure is recommended to catch any rapid re‑registration attempts that may reuse the same Cloudflare edge network.