order75998312[.]icu

order75998312.icu was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare edge address 104.21.4.82 (AS13335, United States). The domain serves an HTTP 302 response and presents the page title “Just a moment…”. TLS is provided by a Google Trust Services certificate issued to WE1, indicating a valid‑looking SSL chain. Cloudflare‑specific technologies are detected, including Cloudflare Browser Insights and HTTP/3, and the authoritative nameservers are deb.ns.cloudflare.com and johnny.ns.cloudflare.com. The site is classified as a brand‑impersonation campaign targeting eBay, and it has been blocked by the PhishDestroy feed.

VirusTotal records five detections out of ninety‑three scanning engines, and the Gridinsoft trust score is 0 / 100, reflecting a high‑confidence malicious assessment. The domain appears on one external security blocklist, reinforcing the detection consensus. The threat is marked as active with a high risk rating. Analysis indicates that the infrastructure relies on a reputable CDN, which can obscure the true origin of any payload and may be used to evade simple IP‑based blocks. The presence of a legitimate‑looking SSL certificate further increases the likelihood of successful social engineering against end users.

While the exact content beyond the generic “Just a moment…” page has not been disclosed, the combination of brand impersonation, multiple vendor detections, and a zero trust score suggests that the site is likely used to harvest credentials or deliver malicious redirects. Defenders should immediately add order75998312.icu to URL filtering and endpoint deny‑lists, enforce TLS inspection to verify the certificate chain, and monitor outbound connections to the 104.21.4.82 address. Network traffic to Cloudflare edge nodes associated with this domain should be logged and, where possible, quarantined.