tu2055[.]it

Analysis of the domain tu2055.it confirms its classification as a phishing site, currently offline but previously active under elevated-risk indicators. Registered on August 12, 2025, through 1 Api GmbH, the domain resolved to IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335) in the United States. The site employed Cloudflare nameservers (aria.ns.cloudflare.com and arturo.ns.cloudflare.com) and utilized HTTP/3, a protocol often leveraged to evade detection or improve performance. SSL certification was provided by Google Trust Services (WE1), a common but not inherently malicious provider.

The domain appeared on one security blocklist, specifically PhishDestroy, and was flagged by 2 of 95 security vendors on VirusTotal, indicating detection by at least two independent engines. The page title 'Welcome aboard' suggests a generic credential-harvesting or onboarding scam, though the exact target or brand impersonation remains unconfirmed due to the lack of detailed content analysis. No evidence of a specific phishing kit or brand association was present in the available data. Infrastructure analysis reveals the use of Cloudflare's services, which are frequently adopted by both legitimate and malicious actors to obscure hosting origins and mitigate DDoS attacks.

The domain's creation date, recent at the time of detection, aligns with common phishing lifecycle patterns, where sites are rapidly deployed and taken offline to avoid prolonged scrutiny. Defenders should treat this domain as a confirmed phishing threat, particularly if observed in logs or proxy traffic. Monitoring for re-registration or shifts to alternative IPs under the same infrastructure is recommended. Given its current offline status, further forensic analysis of the site's content is not possible, but historical DNS and WHOIS records may yield additional indicators of compromise.