order27895[.]netlify[.]app

PhishDestroy identifies order27895.netlify.app as a high-risk social engineering phishing domain actively impersonating legitimate order systems. This platform masquerades as a transactional portal to harvest credentials and payment details from unsuspecting users. The threat actor leverages Netlify’s infrastructure to host a convincing replica of an order management interface, complete with SSL encryption (DigiCert Inc) to appear legitimate. Users interacting with this domain risk exposing sensitive data including login credentials, payment card numbers, and personally identifiable information, which are subsequently weaponized for financial fraud or identity theft. This domain was flagged by Google Safe Browsing under SOCIAL_ENGINEERING and is currently resolving to IP 35.157.26.135. VirusTotal analysis confirms 10 out of 95 security vendors have detected malicious activity associated with this domain. Registered through Netlify, the domain has been active long enough to accumulate these detections, indicating ongoing abuse. The presence of an SSL certificate issued by DigiCert Inc further enhances its deceptive credibility, as modern browsers display the padlock icon despite the domain’s malicious intent. If you visited order27895.netlify.app, PhishDestroy strongly advises immediate action to secure your accounts and data. Disconnect from the site immediately and avoid entering any credentials or payment information. Scan your device for malware using updated antivirus software and consider changing passwords for any accounts that may have been exposed. Report the domain to Netlify and your cybersecurity team to aid in takedown efforts. Monitor financial statements and credit reports closely for signs of fraud. PhishDestroy recommends using a password manager with phishing detection capabilities to prevent future visits to similar malicious domains.