sdg661[.]it

sdg661.it was registered on June 16, 2025 through the registrar 1 Api GmbH and is hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.7.184 located in the United States. The domain resolves to a Cloudflare‑managed server that presented a TLS certificate issued by Google Trust Services under the WE1 designation, and the service was observed supporting HTTP/3. The only visible element on the site, as captured before it was taken offline, was the page title “Welcome aboard”. The site was subsequently taken offline and is currently listed as blocked by the PhishDestroy platform, and it appears on a single external security blocklist.

VirusTotal scans reported that two out of ninety‑five security scanners flagged the domain, indicating a modest but non‑trivial detection rate. No additional intelligence such as Safe Browsing, Open Threat Exchange, or detailed malware kit attribution was available at the time of analysis. The limited evidence points to a generic phishing campaign that likely leverages the welcoming title to lure victims into a credential‑harvesting flow, although the exact target brand or service cannot be confirmed from the collected data.

Defenders should add the domain and its associated IP address to deny‑list rules in DNS filtering and web proxy solutions, monitor for outbound connections to the Cloudflare IP range, and ensure that endpoint protection tools reference the current VirusTotal detection status. Continuous monitoring of the registrar 1 Api GmbH for new domains with similar characteristics and periodic re‑query of blocklist feeds is recommended to catch any re‑activation attempts. Because the site is already offline, immediate incident response is not required, but awareness of the pattern may help prevent future impersonation attempts that reuse the same infrastructure.