setg18[.]it

The domain setg18.it was registered on June 16, 2025 through the registrar 1 Api GmbH and is currently resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative nameservers are celeste.ns.cloudflare.com and kyrie.ns.cloudflare.com, both hosted by Cloudflare, and the service is delivering traffic over HTTP/3. The SSL certificate presented by the site is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS handshake but offering no assurance about the legitimacy of the underlying content.

The page title returned by the server when the site was online was "Welcome aboard," and the domain has been taken offline at the time of this assessment. Threat intelligence shows that the domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reflecting a consensus that the site was being used for malicious purposes. VirusTotal analysis recorded two detections out of ninety‑five scanning engines, providing additional corroboration of suspicious activity.

While the available data confirms that setg18.it was employed in a generic phishing campaign, the exact payload, target audience, and any associated phishing kit remain unknown because the site is no longer reachable for direct inspection. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑use of the same infrastructure (e.g., the Cloudflare IP and nameserver configuration), and update endpoint protection signatures to include the observed VirusTotal detections. Ongoing vigilance is recommended to catch any future re‑activation of the domain or similar patterns emerging from the same registrar or hosting provider.