ehall[.]it[.]it[.]m[.]sonicmenusprices[.]com

The domain ehall.it.it.m.sonicmenusprices.com was registered on May 15, 2026 through Name SRS AB and remains active as of the report date, August 02, 2026. Infrastructure analysis shows the domain is delegated to the Cloudflare nameservers jasper.ns.cloudflare.com and simone.ns.cloudflare.com and resolves to the IPv4 address 104.206.0.154. The hosting provider is identified as Cloudflare, indicating the attacker is leveraging a reputable CDN to mask the true origin of the traffic.

VirusTotal scans have returned 13 positive detections out of 91 security vendors, suggesting that multiple anti‑malware engines have observed malicious characteristics associated with the domain. The domain appears on a single external blocklist and is explicitly blocked by PhishDestroy, confirming that at least one dedicated phishing mitigation service has taken action against it. No public information about the site’s SSL certificate, HTTP response codes, or page title is available, so the exact content served by the domain cannot be verified at this time.

The lack of additional contextual data limits attribution of the phishing campaign to a specific brand or lure, but the classification as generic phishing is supported by the detection count and blocklist entries. Defenders should immediately add 104.206.0.154 and the fully qualified domain name to network‑level deny lists, enforce DNS filtering that includes the known blocklist, and monitor Cloudflare DNS queries for any related sub‑domains that may be created under the same registrar. Continuous re‑scanning of the domain on VirusTotal and periodic WHOIS checks are recommended to capture any changes in registration or hosting that could affect threat posture.