cccartel[.]net

This domain, cccartel.net, is flagged as an active credential phishing site operating since May 15, 2026. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, it resolves to the IP address 37.139.52.6, hosted in France under the provider MRHOSTBIZ. The domain uses nameservers ns1.hosted-by.mrhost.biz and ns2.hosted-by.mrhost.biz, a pattern consistent with known phishing infrastructure. A Let's Encrypt SSL certificate (E8) is present, which is commonly exploited by threat actors to lend superficial legitimacy to malicious sites. Analysis indicates the domain remains active, returning an HTTP 200 status, suggesting the phishing page is operational. Three of 92 security vendors on VirusTotal have detected this domain, though the specific nature of the phishing content has not been fully analyzed. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse, further corroborating its malicious classification. MX records point to mail.cccartel.net with a priority of 10, which may indicate an attempt to establish email legitimacy or facilitate further phishing campaigns. Defenders should treat this domain as high-risk. Immediate actions include blocking the domain and its associated IP (37.139.52.6) at the network perimeter, monitoring for any internal connections to it, and reviewing logs for prior interactions. The use of Let's Encrypt certificates and the MRHOSTBIZ hosting provider suggests this infrastructure may be reused for additional phishing campaigns. Given the domain's recent registration and active status, continued vigilance is warranted. No specific brand or scam type has been confirmed at this time, so generic credential phishing detection rules should be applied.