sdg825[.]it

This domain, sdg825.it, is flagged as a credential theft phishing site targeting users through deceptive login portals. Analysis indicates no direct brand impersonation or cryptocurrency drainer kit association, but the infrastructure and page title ('prima pagina') suggest a generic yet targeted approach to harvesting login credentials. The site employs basic obfuscation techniques, likely to evade automated detection while presenting a seemingly legitimate interface to victims. Infrastructure analysis reveals the domain was registered on October 13, 2025, through Dynadot LLC, a registrar frequently abused for malicious campaigns. It resolves to the IP address 188.114.97.3, a Cloudflare-hosted endpoint leveraging HTTP/3 and HSTS to mimic secure connections. The domain appears on 2 security blocklists and is flagged by 4 out of 95 security vendors on VirusTotal, including detections from ScamSniffer and PhishDestroy. The SSL certificate is issued by Google Trust Services, adding a layer of perceived legitimacy despite the malicious intent. As of the latest verification, sdg825.it has been taken offline, likely due to enforcement actions or abandonment by the threat actor. However, the domain remains a residual risk due to its recent creation date and potential for reactivation. Organizations are advised to block the domain and its associated IP at the network level, monitor for related phishing campaigns, and educate users on recognizing credential theft tactics. Persistent monitoring of newly registered domains under the same registrar or IP range is recommended to preempt similar threats.