order2169[.]icu

Analysis as of July 24, 2026 indicates that the domain order2169.icu is currently offline but exhibits multiple indicators of a brand‑impersonation campaign targeting eBay. The domain was registered on February 22, 2026 through NiceNIC International Group Co., Limited. Its authoritative name servers are deb.ns.cloudflare.com and johnny.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. DNS resolution points to IP address 104.21.4.82, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. No TLS certificate is presented for the host, confirming the absence of HTTPS protection.

Reputation services flag the host as highly suspicious. Gridinsoft assigns a trust score of 1 out of 100, and the domain appears on a single security blocklist. PhishDestroy has recorded the domain as blocked. VirusTotal analysis shows that 11 of 95 scanning engines have flagged the domain, reinforcing the malicious assessment. The page title returned from the HTTP request is “Nur einen Moment…”, which does not correspond to legitimate eBay content and further suggests a deceptive landing page.

The combination of a low trust score, multiple vendor detections, presence on a blocklist, and the use of Cloudflare’s infrastructure without TLS strongly supports classification as a brand‑impersonation threat. Because the site is currently taken offline, live content cannot be examined, and the exact phishing kit or page structure remains unknown. Defenders should continue to block the domain and its resolving IP address at perimeter defenses, add the domain to internal URL filtering lists, and monitor for any future re‑hosting attempts that might reuse the same IP range or name server configuration. Ongoing observation of Cloudflare‑hosted malicious domains is recommended, as the provider’s shared infrastructure can host multiple unrelated campaigns.