fhd166[.]it

Analysis of the domain fhd166.it shows a recent creation date of 12 August 2025 and current resolution to the Cloudflare IP address 172.67.163.251, which is associated with ASN 13335 in the United States. The domain is served through Cloudflare nameservers aria.ns.cloudflare.com and arturo.ns.cloudflare.com and supports HTTP/3, indicating use of modern edge‑caching infrastructure. A TLS certificate issued by Google Trust Services (WE1) is present, confirming that HTTPS connections are encrypted despite the site’s inactivity. The only visible HTTP response is a 522 timeout, reflected in the page title "fhd166.it | 522: Connection timed out," confirming that the host is presently offline or unable to establish a connection to the origin server.

The domain appears on a single security blocklist and has been flagged by PhishDestroy, reinforcing its classification as a phishing‑related resource. VirusTotal scans report that two of ninety‑five security vendors have flagged the domain, providing additional corroboration of malicious intent. Registration was performed through 1 Api GmbH, a registrar known to host a variety of short‑lived domains.

While the exact phishing payload or targeted brand cannot be verified due to the timeout condition, the combination of recent registration, Cloudflare hosting, a valid Google‑issued certificate, and multiple security vendor detections suggests purposeful abuse. Defenders should consider adding fhd166.it to outbound and inbound filtering rules, monitor DNS queries for the domain, and continue periodic re‑resolution checks in case the site becomes active. Further investigation, such as sandboxed retrieval of the landing page when it reappears, would be required to identify the specific credential‑harvesting tactics employed.