fgh336[.]it

The domain fgh336.it was observed hosting a page titled "Welcome aboard" before being taken offline. Technical analysis shows the site was served through Cloudflare, utilizing HTTP/3, and resolved to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. Registration data indicates the domain was created on August 12, 2025 and was registered via 1 Api GmbH, with authoritative nameservers aria.ns.cloudflare.com and arturo.ns.cloudflare.com.

The TLS certificate presented was issued by Google Trust Services under the WE1 designation, confirming the use of a valid HTTPS endpoint. Threat intelligence sources have placed the domain on at least one security blocklist and it is listed as blocked by PhishDestroy. VirusTotal scans recorded two detections out of ninety‑five participating security vendors, reinforcing the suspicion of malicious activity.

Although the site is currently offline, the combination of a credential‑focused page title, recent creation date, cloud‑based hosting, and multiple vendor detections suggests a purposeful credential‑harvesting operation. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any re‑registration attempts, and flag the associated IP range for heightened scrutiny. Ongoing vigilance is advised, especially for any traffic that may attempt to resolve to the same Cloudflare edge nodes, as threat actors could reuse the infrastructure for future campaigns.