italy-news[.]info

Analysis of italy-news.info indicates that the domain is presently offline but was previously serving content with the title “Index of /”. The site was hosted behind Cloudflare (IP 172.67.186.38, located in Canada) and used Google Trust Services / WE1 for its TLS certificate. Registration was performed through Dynadot Inc. The domain appears on a single security blocklist and has been flagged by PhishDestroy. Threat intelligence from AlienVault OTX shows the domain in eight separate pulses, and VirusTotal records show 16 of 91 scanning engines marking it as malicious. Nameservers ethan.ns.cloudflare.com and emely.ns.cloudflare.com confirm the Cloudflare infrastructure. The evidence collectively points to a generic phishing operation, though the specific payload or targeted brand has not been disclosed. Uncertainty remains regarding the active phishing landing pages, the duration of the campaign, and whether any victim data was exfiltrated before the takedown. Defenders should continue to block the domain at perimeter filters, monitor for residual malicious URLs that may have been cached, and update intrusion detection signatures to include the observed IP address and TLS certificate fingerprint. Ongoing intelligence feeds should be consulted for any re‑registration attempts or related indicators of compromise.