zonedirector[.]bellarinox860[.]it

zonedirector.bellarinox860.it was registered on March 11, 2026 through Dynadot LLC and immediately pointed to Cloudflare’s network (nameservers drew.ns.cloudflare.com and daniella.ns.cloudflare.com). The domain resolves to IP 104.21.86.47, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An SSL certificate issued by Google Trust Services (WE1) covers the host, indicating that the site was served over HTTPS. When accessed, the HTTP response returned a 403 status code and the page title displayed “Suspected phishing site | Cloudflare”, suggesting that the content was already flagged by Cloudflare’s protective services.

Google Safe Browsing classifies the domain as a social engineering threat, and the site appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded eight detections out of ninety‑four scanning engines, reinforcing the malicious reputation. The combination of Cloudflare’s block page, safe‑browsing flag, and multiple blocklist listings points to a high‑confidence phishing indicator, despite the current offline status. The exact payload, credential‑harvesting mechanism, and targeted brand or service have not been publicly disclosed; the only observable artifact is the generic phishing page title.

Consequently, analysts cannot confirm the specific lure or victim profile employed by the operator. Nonetheless, the infrastructure choices—rapid domain registration, use of a reputable registrar, and reliance on Cloudflare’s edge network—are consistent with short‑lived phishing campaigns that aim to obscure origin. Defenders should add zonedirector.bellarinox860.it to deny‑list rules for DNS and proxy filtering, monitor outbound traffic for connections to 104.21.86.47, and ensure that endpoint protection solutions reference the latest Google Safe Browsing and VirusTotal feeds.