fgj825[.]it

The domain fgj825.it was registered on 12 August 2025 through the registrar 1 Api GmbH. Its authoritative name servers are listed as aria.ns.cloudflare.com (duplicated) and arturo.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to the IP address 104.21.15.206, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented by the host is issued by Google Trust Services under the WE1 label, confirming that HTTPS is terminated at Cloudflare’s edge.

HTTP traffic is served over HTTP/3, consistent with Cloudflare’s modern delivery stack. Passive scanning on VirusTotal shows that 2 of 95 security vendors have flagged the domain as malicious, and the site appears on a single external blocklist. The domain is currently listed as taken offline and is blocked by the PhishDestroy feed. The landing page title returned by the web server is “Welcome aboard”, but no further content analysis is available.

Taken together, the registration timing, Cloudflare‑based infrastructure, short‑lived domain age, and the presence on a phishing‑oriented blocklist justify an elevated risk assessment. The limited vendor detections suggest that the site may have been active for a brief window before takedown. Defenders should continue to block DNS resolutions to 104.21.15.206 for any traffic to fgj825.it, monitor for re‑registration, and ensure that web filtering solutions reference the blocklist entry from PhishDestroy. Additional investigation of the page content, if the site reappears, would be required to confirm the exact phishing payload.