sdg158[.]it

This domain, sdg158.it, was registered on June 16, 2025, and is currently offline following detection as a generic phishing threat. Analysis indicates the domain was flagged by at least one security blocklist (PhishDestroy) and received marginal detection from security vendors, with two of 95 vendors on VirusTotal identifying it as malicious. The domain resolved to a Cloudflare IP (172.67.207.204, AS13335) in the United States, utilizing Cloudflare nameservers (celeste.ns.cloudflare.com and kyrie.ns.cloudflare.com) and HTTP/3 protocol. The SSL certificate was issued by Google Trust Services (WE1), a common configuration for both legitimate and malicious sites leveraging Cloudflare’s infrastructure.

The page title, 'Welcome aboard,' provides no clear indication of the targeted brand or specific phishing campaign, and no additional evidence of a known phishing kit or brand impersonation is present in the available data. Infrastructure analysis reveals reliance on Cloudflare’s network, which is frequently abused by threat actors to obscure hosting origins and evade takedowns. The domain’s registration through 1Api GmbH, a known registrar for both legitimate and malicious domains, offers no definitive attribution. While the domain is currently offline, defenders should treat it as a confirmed phishing indicator due to its presence on a security blocklist and marginal vendor detections.

No evidence suggests persistence or active exploitation at this time, but historical resolution data and SSL certificate details may assist in identifying related infrastructure. Further investigation into the domain’s registration and hosting history, as well as correlation with other known phishing campaigns, is recommended to determine if this domain is part of a broader threat cluster. Defenders should monitor for re-emergence or similar domains leveraging identical infrastructure patterns.