verificator[.]cc

The domain verificator.cc was registered on July 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Within days of activation it began appearing on three public security blocklists and was incorporated into an AlienVault OTX pulse, indicating that at least one community source has observed malicious use. DNS resolution points to the IPv4 address 192.162.199.184, which is currently listed by PhishDestroy, MetaMask, and SEAL as a prohibited destination. VirusTotal has recorded 19 of 91 scanned security engines flagging the domain, reinforcing the blocklist findings.

At the time of writing no public TLS certificate information, HTTP response codes, or page‑title metadata have been published, so the exact payload or credential‑harvesting technique employed by the site cannot be confirmed. The lack of visible brand or campaign identifiers further limits attribution, but the convergence of blocklist listings, multi‑vendor detections, and an OTX pulse provides sufficient confidence to treat verificator.cc as a high‑risk phishing infrastructure. The rapid appearance of the domain on multiple defensive feeds within a two‑week window points to an automated deployment likely tied to credential‑stealing kits that reuse infrastructure across campaigns. While the exact phishing kit cannot be identified from the current dataset, the pattern aligns with known fast‑flux style phishing operations that rely on disposable domains and shared hosting.

Defenders should immediately add the domain to network‑level deny lists, enforce URL filtering on corporate proxies, and monitor outbound connections to the associated IP address. Incident response teams should also inspect recent logs for any attempt to resolve or contact verificator.cc, as early exposure may indicate credential capture attempts. Continuous re‑evaluation is advised, as additional intelligence such as SSL details or content analysis may emerge.