gioielleriaorologeriabobba[.]it

Analysis indicates that the domain gioielleriaorologeriabobba.it is actively impersonating American Express as part of a high-risk brand impersonation scheme. Registered on February 21, 2026, through Tucows.com Co., the domain resolves to the IP address 23.227.38.65, associated with Cloudflare, Inc. (AS13335) in Canada. The site presents itself under the title 'Gioielli e Orologi di Marca | Oreficeria e Orologeria Bobba,' which does not align with the known branding of American Express, suggesting an attempt to mislead visitors into believing they are interacting with a legitimate financial services entity. Infrastructure analysis reveals the use of Shopify as the underlying platform, alongside technologies such as Hextom Ultimate Sales Boost, Pandectes, and OptiMonk, which are commonly employed in e-commerce environments. The presence of these tools does not inherently indicate malicious activity but may facilitate the execution of fraudulent transactions or data collection. The domain is secured with a Let's Encrypt SSL certificate, a standard practice that does not mitigate the risk of impersonation. The domain appears on one security blocklist and is flagged by PhishDestroy, with a Gridinsoft trust score of 0/100, reinforcing its classification as a high-risk entity. One of 93 security vendors on VirusTotal has detected the domain as malicious, providing further evidence of its suspicious nature. Nameservers are hosted on SiteGround (ns1.siteground.net, ns2.siteground.net), a legitimate provider often leveraged by threat actors to blend in with benign traffic. Defenders should treat this domain as an active threat. Network-level blocking is recommended, particularly for organizations or users associated with the targeted brand. Monitoring for related domains registered under similar patterns or infrastructure may help identify broader campaigns.