onlinemallo[.]fit

On July 23, 2026, the domain onlinemallo.fit was observed to be offline but retained multiple indicators of malicious activity consistent with brand‑impersonation campaigns. The domain was registered on October 08, 2024 through DNSPod, Inc. and resolves to the IP address 38.85.201.48, which is allocated to AS8796 FASTNET DATA INC in the United States. The authoritative name servers are nolan.ns.cloudflare.com and poppy.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS infrastructure. No SSL certificate was presented for the site, indicating that any HTTP traffic would have been unencrypted.

The only visible page title retrieved before takedown was “TK‑Store | buy, sell and discover on TK”, a generic e‑commerce phrasing that does not reveal the targeted brand directly; however, intelligence tags the domain as impersonating the brand “across”. The domain appears in 16 AlienVault OTX pulses, and 15 of 95 security vendors on VirusTotal flagged it as malicious, reinforcing the suspicion of phishing or scam activity. PhishDestroy has added the domain to its blocklist, and it is listed on at least one additional security blocklist, providing multiple layers of defensive detection. The combination of a recent registration, use of a reputable DNS provider, hosting on a US‑based ASN, lack of TLS, and the presence on threat‑intel feeds indicates a purpose‑built infrastructure for brand impersonation.

Because the site is currently offline, a full content analysis could not be performed; therefore the exact tactics, credential‑harvesting mechanisms, or payloads remain unknown. Defenders should continue to block the domain at network perimeters, update DNS sinkhole rules to intercept any future resolution attempts, and monitor related indicators such as the hosting IP 38.85.201.48 and the Cloudflare name servers for re‑use in other campaigns.