order49691[.]icu

Analysis of order49691.icu shows a newly registered domain created on February 21, 2026 that was used to impersonate eBay. The site presented the generic page title "Just a moment..." and was built on a Node.js stack running Express, served through Cloudflare with HTTP/3 enabled. DNS resolution points to IP address 104.21.4.82, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. The domain is delegated to Cloudflare nameservers deb.ns.cloudflare.com and johnny.ns.cloudflare.com.

No TLS certificate was observed, indicating the site was likely accessed over plain HTTP or relied on Cloudflare’s default SSL handling, which was not present at the time of analysis. The registrar listed is NiceNIC International Group Co., Limited. Reputation scoring from Gridinsoft assigned a trust score of 1 out of 100, reflecting extreme suspicion. VirusTotal scans recorded six detections out of ninety‑three submitted security vendors, corroborating malicious intent.

The domain has been taken offline, is blocked by the PhishDestroy sinkhole, and appears on a single security blocklist. While the page content beyond the title has not been captured, the combination of brand impersonation labeling, low trust score, vendor detections, and Cloudflare‑based hosting strongly suggests a phishing campaign targeting eBay users. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same IP or infrastructure, and add the domain to internal threat intelligence feeds. Additional investigation is warranted to determine whether the same actor is reusing the Cloudflare IP range for other fraudulent sites, but current evidence points to a short‑lived eBay impersonation operation that has already been mitigated.