enzaro-pilletto[.]com

Analysis of enzaro-pilletto.com shows a domain created on February 21, 2026 and registered through Spaceship, Inc. The site resolves to IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain is currently taken offline, and it does not present an SSL certificate, leaving HTTP connections unencrypted. The page title returned from the site – “BTC +590 Nerion — Official site for real-time market analysis” – bears no direct relationship to the advertised brand, yet the domain is classified as a brand impersonation campaign targeting American Express (Amex). The domain appears on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL.

Google Safe Browsing flags the URL for social engineering, and Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal reports a single detection out of 93 scanned security vendors, confirming at least one vendor flagged the domain as suspicious. Nameservers eoin.ns.cloudflare.com and lauryn.ns.cloudflare.com are present, consistent with the Cloudflare hosting.

While the exact content of the landing page has not been captured, the combination of brand impersonation labeling, blocklist presence, lack of TLS, low trust score, and vendor detections suggests a high risk of fraudulent activity. Defenders should continue to block the domain at network perimeter and DNS levels, monitor for any resurgence, and educate users that any unsolicited communications referencing Amex that direct to this domain are malicious. Ongoing observation of the IP address and associated Cloudflare accounts is recommended to detect potential re‑hosting of the campaign.