persiarestaurant[.]no

persiarestaurant.no was registered through the NETIM registrar and resolves to Cloudflare name servers magdalena.ns.cloudflare.com and garret.ns.cloudflare.com. The domain currently returns an HTTP 301 redirect, indicating an active web service. On VirusTotal the host was examined by 91 scanning engines; at the time of analysis none of the engines reported a detection. The domain appears on a single external blocklist and is listed as blocked by the PhishDestroy feed, suggesting that at least one threat‑intelligence provider has identified it as malicious.

No additional public reputation services, such as Google Safe Browsing or OTX, are referenced in the available data. The lack of reported detections does not imply benign intent, and the presence on a phishing‑oriented blocklist warrants caution. Infrastructure analysis shows the domain is hosted behind Cloudflare, a common choice for threat actors seeking anonymity and DDoS mitigation. No SSL certificate details, IP address information, or page title have been disclosed, limiting the ability to confirm the specific content or targeted brand.

Consequently, the primary observable indicators are the registrar (NETIM), the Cloudflare DNS configuration, the HTTP 301 response, and the blocklist entry. Defenders should consider adding persiarestaurant.no to outbound filtering rules, monitoring DNS queries for the associated name‑servers, and reviewing any internal logs for connections to the domain. Continuous re‑scanning on VirusTotal and other sandbox services is recommended to detect any future payloads or changes in behavior. Until further forensic evidence is obtained, the domain remains classified as an active phishing infrastructure under investigation.