sdg392[.]it

The domain sdg392.it was created on 12 August 2025 and is registered through 1 Api GmbH. Technical analysis shows the domain resolves to IP address 104.21.4.213, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. The site was served over HTTPS using a Google Trust Services certificate issued to the WE1 authority, confirming a valid TLS handshake at the time of capture. Cloudflare’s services, including HTTP/3, are observed in the response headers, and the authoritative name servers are aria.ns.cloudflare.com and arturo.ns.cloudflare.com.

The only visible page element is the title “Welcome aboard,” but the site has been taken offline, limiting any current content inspection. VirusTotal scans recorded detections by two of ninety‑five security vendors, indicating that at least a minority of scanners flagged the domain as malicious. The domain appears on a single security blocklist and has been specifically blocked by the PhishDestroy mitigation service.

While the limited data prevents a full description of the phishing payload, the combination of recent registration, Cloudflare hosting, a valid SSL certificate, and vendor detections align with typical infrastructure used for credential‑harvesting sites. Defenders should add sdg392.it to URL filtering rules, block the associated IP 104.21.4.213 at network perimeter devices, and monitor for other newly registered domains using the same registrar or Cloudflare name servers. Continuous re‑scanning of the domain is recommended in case the site reappears, and any observed traffic to the IP should be logged for further threat‑intel correlation.