gpf833[.]it

Analysis of the domain gpf833.it shows a recent registration date of February 21, 2026, indicating a short operational window before it was taken offline. The domain resolves to the IP address 104.21.64.1, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. Cloudflare hosting is common among malicious actors because it provides rapid deployment and basic anonymity. The site presented a page title of "Welcome aboard," but no further content has been publicly disclosed, leaving the exact phishing lure and any targeted brand undefined.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of credibility. The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one defensive platform recognized it as malicious. VirusTotal scans reported that two out of ninety‑five security vendors flagged the domain, indicating limited but present detection across the scanning ecosystem. The SSL certificate is identified only as "WE1," providing no additional validation of legitimacy.

Current status shows the domain is offline, which may be a temporary takedown or an operational pause by the threat actor. Defenders should continue to block the domain and its associated IP address, monitor for re‑registration or activity from the same Cloudflare AS, and add the domain to internal allow‑list exclusions. Given the low trust score, presence on a blocklist, and the modest vendor detections, it is advisable to treat any future traffic to gpf833.it as hostile and to employ URL filtering, DNS sinkholing, and endpoint protection to prevent credential harvesting or other phishing‑related compromise.