We had a user places 3 orders relatively quickly. The order total in VM was always $2048.
The first order was pending and confirmed in VM, but $0 was sent to Authorize.net, then approved.
The second order was pending and confirmed in VM, but $0 was sent to Authorize.net, then approved.
The third order was pending only in VM, with $2048 was sent to Authorize.net and declined.
10.0.0.0.1 (https://100001.link/) Coloring Pages (https://coloringpages.dev/) 192.168.1.254 (https://1921681254.link/)
Any help on how to investigate this? I do have the raw logs, VM order, and Authorize.net transaction data.