fin-norvello[.]it

Analysis of fin-norvello.it, created on 21 February 2026 and currently taken offline, shows multiple indicators of a high‑risk phishing operation. The site presented the page title “Finance +760 Norvello — a digital asset portal with superior privacy safeguards”, suggesting an attempt to lure victims interested in digital assets. Infrastructure inspection reveals the domain resolves to IP 188.114.96.3, hosted behind Cloudflare (AS13335, United States). The SSL certificate is issued by Google Trust Services under the WE1 intermediate, indicating a legitimate‑looking TLS layer.

HTTP requests return a 403 status, which may be a defensive measure after takedown. Registration was performed through Dynadot LLC, with nameservers malavika.ns.cloudflare.com and nico.ns.cloudflare.com. The domain is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing categorises the URL as social engineering, and VirusTotal records four detections out of ninety‑three scanners.

These data points collectively confirm the domain’s use for phishing. Uncertainty remains regarding the exact content served before the site was taken offline, as no page capture is available. Defenders should continue to monitor the IP address 188.114.96.3 for related activity, update intrusion‑detection signatures with the observed domain and certificate details, and ensure that any inbound traffic to the associated Cloudflare IPs is inspected for malicious payloads. Blocking the domain at the DNS resolver level and sharing the indicators with threat‑intel communities will help mitigate residual risk.