berlusconi-cc[.]to

The domain berlusconi-cc.to is currently active and was registered on October 15, 2025 through the Government of the Kingdom of Tonga. It resolves to the Cloudflare IP address 172.67.70.170, which is geolocated to Canada, and presents a valid SSL certificate issued by Google Trust Services (WE1). An HTTP request to the site returns a 200 status code and the page title reads "Berlusconi || Berlusconi Login || berlusconi-cc.to || Berlusconi Market," indicating an attempt to mimic a legitimate service.

Infrastructure analysis reveals a modern web stack built on Node.js, employing Next.js, Express, React, Bootstrap, and Webpack, with Google Analytics embedded for traffic tracking. The domain is served behind Cloudflare, using the nameservers norman.ns.cloudflare.com and zariyah.ns.cloudflare.com. Reputation services assign a Gridinsoft trust score of 0 out of 100, and VirusTotal reports three detections out of ninety‑five security vendors, confirming malicious indicators. The domain appears on one public blocklist and is actively blocked by PhishDestroy.

Based on the observed page title, low trust score, and vendor detections, the site is classified as a credential phishing operation targeting users who may believe they are accessing a "Berlusconi" service. The evidence points to a deliberate credential‑harvesting campaign, though the limited number of blocklist entries leaves the full scope of distribution uncertain.

Defenders should add berlusconi-cc.to to DNS blocklists and enforce URL filtering to prevent access. Network monitoring should flag any outbound connections to the IP 172.67.70.170, and email security solutions must flag messages containing this domain. Organizations should assume any credentials submitted to the site are compromised and advise users to change affected passwords immediately. Ongoing surveillance of related Cloudflare‑hosted assets is recommended to detect potential expansions of the campaign.