orderwagarilla[.]com

Analysis of the domain orderwagarilla.com, registered on July 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, indicates active phishing infrastructure. The domain currently resolves to the IP address 188.114.96.3, which is associated with Cloudflare network services, as evidenced by the nameservers garrett.ns.cloudflare.com and raphaela.ns.cloudflare.com. This configuration is consistent with threat actors leveraging Cloudflare's proxy services to obscure hosting origins and evade detection. As of August 1, 2026, the domain remains active and has been flagged by two of 91 security vendors on VirusTotal, suggesting limited but confirmed malicious classification.

Additionally, the domain appears on one security blocklist, specifically PhishDestroy, further corroborating its phishing status. The low detection count does not imply safety, as phishing domains often evade initial detection through rapid deployment and proxy obfuscation. Infrastructure analysis reveals no additional brand-specific targeting or scam categorization in the available data. The exact content and intended victim profile of the phishing site remain unconfirmed, as no page title, brand target, or scam type has been provided.

Defenders should treat this domain as high-risk due to its recent registration, active status, and confirmed phishing classification. Network-level blocking at the IP 188.114.96.3 and domain level is recommended pending further analysis. Organizations should monitor for connections to this domain in logs and alert users to avoid interaction with orderwagarilla.com.