forte-rendovale[.]org

Analysis of the domain forte-rendovale.org indicates that the site was registered on March 5 2026 through NameCheap, Inc. The domain resolves to the IP address 172.67.195.102, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The authoritative nameservers are vivienne.ns.cloudflare.com and wesley.ns.cloudflare.com, consistent with the Cloudflare hosting profile. No TLS certificate is presented, and the site is currently taken offline, which suggests that the malicious content has been removed or the hosting has been disabled. The page title retrieved during the brief observation period reads “Forte Rendovale | Investimenti automatizzati con IA per investitori moderni,” indicating an investment‑oriented phrasing that aligns with the generic phishing classification.

The domain appears on three independent blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that multiple security operators have flagged it. VirusTotal scans show that four of ninety‑four AV engines flagged the domain, providing additional corroboration of malicious activity. The combination of recent registration, Cloudflare infrastructure, lack of encryption, and presence on blocklists suggests the domain was used for a short‑lived phishing campaign targeting investors interested in AI‑driven financial services.

Because the site is offline, active exploitation is likely halted, but the registration pattern and hosting choice indicate a reusable template that could be redeployed under a new domain. Defenders should monitor for similarly titled domains registered through NameCheap and hosted on Cloudflare, add the IP 172.67.195.102 to deny‑list rules where appropriate, and continue to reference the three blocklists for early detection. Ongoing vigilance is recommended to catch re‑appearances or related infrastructure.