sgf115[.]it

sgf115.it was registered on 16 June 2025 through the registrar 1 Api GmbH. The domain resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., placing the host in the United States. DNS resolution is handled by the Cloudflare nameservers celeste.ns.cloudflare.com and kyrie.ns.cloudflare.com. The site is fronted by Cloudflare and supports HTTP/3, indicating the use of a modern CDN for traffic acceleration and obfuscation.

The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS handshake despite the underlying malicious intent. When accessed, the HTTP response returned a 522 “Connection timed out” status, as reflected in the page title “sgf115.it | 522: Connection timed out”. The domain has been listed on at least one security blocklist and is currently blocked by the PhishDestroy feed. VirusTotal analysis shows that 2 of 95 scanning engines flagged the domain, providing additional corroboration of its malicious nature.

The infrastructure suggests a typical phishing deployment that leverages Cloudflare’s protection to hide the true origin of the payload and to evade simple IP‑based blocking. The lack of a publicly visible landing page prevents immediate content analysis, so the exact phishing vector, targeted brand, or credential‑capture mechanism remains unknown. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole lists with the resolved IP and nameserver entries, and monitor for any future re‑registration of the same second‑level domain. Because the TLS certificate is valid, reliance on certificate validation alone is insufficient; threat‑intel feeds and blocklist correlations remain the primary source of detection for this indicator.