order2179[.]icu

Analysis of order2179.icu indicates a recently established domain exhibiting characteristics consistent with phishing infrastructure. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to IP address 188.114.96.3, which is part of Cloudflare's network (AS13335) and geolocated in the United States. The domain uses Cloudflare nameservers (deb.ns.cloudflare.com and johnny.ns.cloudflare.com), a common configuration for both legitimate services and malicious actors leveraging Cloudflare's proxy and privacy features. No SSL certificate was detected for this domain, which is atypical for modern web services and raises suspicion.

At the time of assessment, the domain was offline, returning a page titled 'Just a moment...', a default placeholder often associated with Cloudflare's interstitial pages or domains in a transitional state. This status may indicate temporary takedown, reconfiguration, or evasion efforts by the operator. Security vendor detections on VirusTotal report 8 flags out of 93 engines, suggesting moderate confidence in malicious classification. The domain appears on at least one security blocklist, specifically PhishDestroy, further supporting its association with phishing activity.

While the exact brand or service being mimicked is not identified in available data, the domain name (order2179.icu) and infrastructure patterns align with credential harvesting or order confirmation scams. Defenders should treat this domain as high-risk for phishing campaigns. Recommended actions include blocking resolution at DNS and network levels, monitoring for related subdomains or newly registered domains with similar naming conventions, and alerting users to potential phishing attempts referencing this domain. Given its recent registration and Cloudflare hosting, continued vigilance is advised as the infrastructure may be repurposed or reactivated.