rky[.]delizicucina[.]com

Analysis of the domain rky.delizicucina.com indicates active phishing infrastructure targeting users through credential harvesting pages. The domain, registered on May 09, 2026, via Gname.com Pte. Ltd., currently resolves to IP address 104.21.38.22, hosted on Cloudflare’s network in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (keanu.ns.cloudflare.com and lovisa.ns.cloudflare.com), a common pattern observed in phishing campaigns to obscure hosting origins and evade takedowns. The domain remains operational with an HTTP 200 status, confirming active content delivery at the time of this report. Security vendors have flagged this domain with low confidence, as evidenced by a 4/95 detection rate on VirusTotal. While this number is modest, it aligns with the domain’s recent registration and the use of Cloudflare’s proxy services, which often delay or reduce detection rates. The domain appears on one security blocklist, specifically PhishDestroy, which categorizes it as a high-risk phishing threat. The Gridinsoft trust score of 0/100 further corroborates the domain’s malicious classification, though the specific phishing kit or targeted brand remains unconfirmed. The SSL certificate issued by Google Trust Services (WE1) does not provide additional indicators of compromise but is consistent with the domain’s use of Cloudflare’s infrastructure. Defenders should treat this domain as an active threat, particularly in environments where credential theft poses a significant risk. Network-level blocking of 104.21.38.22 and the domain itself is recommended, alongside monitoring for related subdomains or IP shifts, as threat actors frequently rotate infrastructure. Given the domain’s recent creation and low detection rates, additional scrutiny of user interactions with this domain is advised to identify potential compromise.