mh6215.it is a scam: three domains, two case files, one account

A note first: we are a law firm and we handle online fraud cases only. If you want our help, fill in the form at the bottom of this article.

We have already handled this case and we can help people who have fallen into the same trap. mh6215.it is a scam, and in this article we also explain how we linked it to two other domains we had already found in a completely different case file, belonging to another injured party.

A name that means nothing

Two letters and four digits. It is not a brand, not an abbreviation, it means nothing in any language: mh6215.it is a number plate.

That is not an accident. A meaningless name is not remembered, not mentioned to a friend, not searched for online and, above all, is worth nothing: when the domain gets reported, you throw it away and open another one, identical in substance and different in its digits. Whoever builds these sites does not want a brand to grow, they want a container to replace.

That is why the name of mh6215.it follows a pattern we keep seeing come back: two or three letters, four digits, an Italian extension to look local.

The finding: the same pair of nameservers

We checked the technical data of mh6215.it in November 2026, and this is where it became interesting.

mh6215.it delegates the management of its names to two nameservers on the Cloudflare network: harvey and wally. They are exactly the same two we had already found, months earlier and in another file, on fgre369.it and on zs8596.it — two sites used against a different person, in a story with no apparent connection to this one. We re-checked all three at the same moment: identical pair, in all three cases.

An honest explanation is needed here, because a great deal of nonsense is written on this point.

Sharing an IP address proves nothing. Behind a single address on a large content-delivery network there can be hundreds of thousands of sites with nothing in common. Anyone building an accusation on a shared IP is building on nothing.

And having different IP addresses proves nothing to the contrary. The three domains we are discussing answer from different address blocks, and that does not separate them at all.

What matters is something else: the pair of nameservers Cloudflare assigns is not per domain, it is per account. Whoever opens an account receives two names drawn from a very large list, and every domain they add to that account is delegated to that same pair. Finding the same pair on three different domains is therefore a strong indicator that those three domains are administered by the same hand. We do not call it absolute proof — the list of names is finite and a coincidence is not mathematically impossible — but it is a solid indicator, very different from the randomness of an IP.

Why this changes how the work is done

mh6215.it, fgre369.it and zs8596.it: three domains, two files, two injured parties who do not know each other, one administration.

The practical consequence is concrete. If the domains are managed from a single account, there is no need to ask three different parties for the same information three times: you ask for the data of that account — the name on it, the registration email, the payment method, the login addresses, the list of linked domains. A single order can light up the whole structure, including domains we do not yet know exist.

And the two files can speak to each other. Two stories that looked independent become episodes of the same design, with everything that follows from this under the continuing-offence rule in article 81 of the Italian criminal code. For someone who has been defrauded it means no longer being an isolated case: it means being part of a larger position, far harder to shelve.

.it domains are not anonymous

There is a reason why the Italian extension of mh6215.it is good news, and it is worth knowing.

For .it domains the registrant's details are collected by the Italian Registry, which is part of a public research body. Contact details are no longer publicly visible for individuals, as data-protection law requires, but they exist and they are kept, and the judicial authority can obtain them with a request that does not have to go through any letter of request abroad.

In plain terms: on a .it you get in weeks what, on a domain registered through a provider in an anonymity haven, takes months and often never arrives at all. Anyone dealing with mh6215.it has a shorter road ahead of them than they imagine.

The file: a work offer, then the fake recoveries

In the mh6215.it file the story began in February 2025 and dragged on into 2026, with payments made by bank transfer abroad. The starting point was not an investment: it was an offer of work and online earnings, which arrived through someone she knew. After the loss came the fake-recovery attempts, which for a couple of years now have systematically followed every successful fraud.

There is one detail we flag because it is itself an element: the injured party never received from her counterparties any verifiable reference — no full corporate name, no identity document, no premises, no written contract.

That is not an oversight and it is not even strange. It is the operating requirement. An activity that presents itself without checkable references is not an informal activity: it is an activity built not to be reachable. And the total absence of identifying data, together with promises of earnings, is one of the elements that in criminal proceedings helps to establish the artifice and deceit required by article 640 of the Italian criminal code.

The absence of a written contract, it has to be said clearly, prevents nothing: transfers, conversations, recordings and emails prove the relationship, its subject and the payments. That material is perfectly workable.

What to do now

Save the screenshots of mh6215.it while it still answers. The site is live now. In a few weeks the name will have been replaced by another, and your copy will be the only proof that the site existed.

Write down the names of the domains, all of them. If different addresses were given to you over the months, list them in date order. It is precisely from that list that the threads are pulled: without those names the link we found would never have surfaced.

Ask your bank for the full trail of every transfer: destination IBAN and account holder, receiving bank, country, date and time. For euro transfers made after 9 October 2025, also ask for the outcome of the verification of payee the bank is obliged to carry out.

File the complaint and expressly ask for the registrant's data to be obtained from the Italian Registry, and the account data from the nameserver operator. These are specific requests: if they are not written down, they are not made.

Do not pay for any fake recovery connected to mh6215.it. Anyone asking you for money in order to give you money back is defrauding you a second time.

Similar cases we have handled

The mh6215.it pattern repeats under different names — and two of these are the linked domains this article is about:

• fgre369.it: two domains, the same account
• zs8596.it: the second site and the domain rotation
• crafthousejp.com: the fake work-from-home task scheme
• eccfinvestigators.com: the fake fund-recovery investigators
• revexglobal.net: five domains, five different providers
• globalnbcfinance.com: the fake platform update

A warning that concerns us directly

We are aware that someone is telephoning defrauded people using our firm's name. We never call on our own initiative, we do not telephone in the evening or at night, we do not use foreign numbers and we never ask for money by telephone. If you receive a call like that, hang up and write to us through the form on this site.

If this happened to you, write to us

If you have had dealings with mh6215.it, or with a site whose name is made of a few letters and four digits, fill in the form at the bottom of this page. Give all the site names you were given, the payment dates and the amounts.

Those names, on their own, look like nothing. Set side by side they become a structure: that is how we linked mh6215.it to two other domains and to a file we did not know we already had.