# PhishDestroy domain threat record: coveredbywise.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/coveredbywise.com/ Machine-readable companion: https://phishdestroy.io/domain/coveredbywise.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 21:34:23 UTC - Last availability or vendor check: 2026-10-26 00:20:56 UTC - Stored record updated: 2026-10-26 00:20:56 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 172.67.161.244 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-22 10:42:53 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a174fb-729e-7628-ac7a-0e1ecde2e6ec/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/coveredbywise.com - Certificate Transparency search: https://crt.sh/?q=%25.coveredbywise.com - Web Archive lookup: https://web.archive.org/web/*/https://coveredbywise.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview An earlier automated assessment described the page as clean, noting no impersonation or malicious code. PhishDestroy added coveredbywise.com to its internal blocklist on 2026-10-25 after an admin report highlighted the three‑day‑old domain. The recorded page title reads “Temporary Car Insurance from 1 Hour | CoveredByWise” and the site advertises short‑term car insurance. How the scam works The suspicious label indicates the domain could be used to lure visitors with deceptive offers such as fake short‑term insurance, but no specific phishing form, credential harvest, or wallet‑draining mechanism was observed on the captured page. Evidence VirusTotal scanned the domain on 2026-10-25 with 92 engines and reported 0 malicious and 0 suspicious detections. Google Safe Browsing checked the same day and did not flag the URL. OTX listed four pulses referencing the domain as of 2026-10-25. Cloudflare Radar’s automated analysis on 2026-10-25 tagged the site with a phishing label. urlscan.io’s machine‑learning engine gave a malicious score of 96 on 2026-10-25, but its overall verdict was non‑malicious. PhishDestroy’s internal list marked the domain as suspicious on 2026-10-25. No external blocklists reported the domain. Infrastructure The domain was registered on 2026-10-22 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS records captured on 2026-10-25 resolve to Cloudflare A addresses 172.67.161.244 and 104.21.15.79 and AAAA addresses 2606:4700:3030::6815:f4f and 2606:4700:3036::ac43:a1f4. The site presented a Let’s Encrypt certificate issued on 2026-10-22, valid until 2027-01-20, covering *.coveredbywise.com and coveredbywise.com. Nameservers are charles.ns.cloudflare.com and molly.ns.cloudflare.com, and DNSSEC is not enabled. What to do Visitors should avoid submitting personal or payment information on the site; if any credentials were entered, change them promptly. Organizations should block outbound traffic to coveredbywise.com, monitor access logs for connections to the domain, and keep the domain on watchlists for further analysis. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a174fb-729e-7628-ac7a-0e1ecde2e6ec/ Cloudflare Radar report: https://radar.cloudflare.com/scan/b69d26a7-d415-40b8-983a-4175d4589f09 Stored capture screenshot: https://i.ibb.co/mryhnbQP/ee27a75a1862.png Cloudflare Radar screenshot (2026-10-25T22:07:05Z): https://screenshots.phishdestroy.io/cf/b69d26a7-d415-40b8-983a-4175d4589f09.png URLScan screenshot (2026-10-25T21:36:01Z): https://screenshots.phishdestroy.io/us/01a174fd-bbcc-706a-a4ab-d4c9b635750e.png URLScan capture report: https://urlscan.io/result/01a174fd-bbcc-706a-a4ab-d4c9b635750e/ VirusTotal report: https://www.virustotal.com/gui/domain/coveredbywise.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=coveredbywise.com Archived copy: https://web.archive.org/web/20261025213535/https://coveredbywise.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 22:08:28 UTC ## Stored page captures - Primary capture: https://i.ibb.co/mryhnbQP/ee27a75a1862.png Captured: 2026-10-25 21:34:23 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a174fb-729e-7628-ac7a-0e1ecde2e6ec.png Captured: 2026-10-25 21:34:23 UTC Source report: https://urlscan.io/result/01a174fb-729e-7628-ac7a-0e1ecde2e6ec/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b69d26a7-d415-40b8-983a-4175d4589f09.png Captured: 2026-10-25 22:07:05 UTC Source report: https://radar.cloudflare.com/scan/b69d26a7-d415-40b8-983a-4175d4589f09 SHA-256: e6eb890da6106d0a070b7a41f94ee8a6129931c1e9e1f83df5818d791142c75e - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a174fd-bbcc-706a-a4ab-d4c9b635750e.png Captured: 2026-10-25 21:36:01 UTC Source report: https://urlscan.io/result/01a174fd-bbcc-706a-a4ab-d4c9b635750e/ SHA-256: 4f9e5fd1451abff4195c4c307cfe2427673b048917bd5a6e25fb30ac420a0e8e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T21:46:52Z", "uuid": "01a174fb-729e-7628-ac7a-0e1ecde2e6ec", "scanned_at": "2026-10-25T21:33:25Z", "final_url": "https://coveredbywise.com/", "status": 200, "ip": "172.67.161.244", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.14.94", "2a00:1450:4001:c1f::5f", "172.67.161.244" ], "asns": [ "15169", "13335" ], "countries": [ "US", "DE" ], "doc_hash": "f544a69c6ef9d8e03823f6bbf3280b929b6fe06142bc60ddcec38853f8c47a2f", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "d151f8c0b2659cfb63704d68654ad8d9437ae9da4410536f63ddec21689a0620", "fca8dd4ee9c93f33dc3149e2c78aec8a28c54036faaf19c7b0ac9ca32293c070", "8b083f64f2e9e8ac445c730dfce7013cc6449ce155fd1c2f42b60edba4ecb4b1", "17daa5f5929c3deab38ffaacd89b213810e35e7d3ee115fc890b6bfdc230a9ad", "f8cf0d3184643f228c7feabc0804ba55499c04c13c54c8764d4ae180e54b9881", "c50a0b33030ba0ec063be642c297f48af94359e2222ff140817248d591faf837", "0eb862a5891526d089b727fdfa30222cca4b4d75b5835727bf57df17436256f6" ], "globals": [ "jQuery", "wc_add_to_cart_params", "woocommerce_params", "sbjs", "wc_order_attribution", "Cookies", "on_keydown_remove_from_cart", "focus_populate_live_region", "refresh_sorted_by_live_region", "on_document_ready" ], "cookies": [ "sbjs_migrations", "sbjs_current_add", "sbjs_first_add", "sbjs_current", "sbjs_first", "sbjs_udata", "sbjs_session" ], "tls": { "san": [ "*.coveredbywise.com", "coveredbywise.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "coveredbywise.com", "protocol": "QUIC", "valid_to": "2027-01-20T11:51:34Z", "valid_from": "2026-10-22T11:51:35Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 3, "tls_valid_days": 89, "requests": 19, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/7.4.33", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff\nnosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T22:07:45Z", "uuid": "b69d26a7-d415-40b8-983a-4175d4589f09", "scanned_at": "2026-10-25T22:07:05Z", "final_url": "https://coveredbywise.com/", "status": 200, "history": [ { "url": "https://coveredbywise.com/", "status": 200 } ], "dom_hash": "5b6ce1de95b70bb198955bb4ad4b5cd545a313869de7053857e5e6d3780adc70", "doc_hash": "ab2dbbdb11a112e474dca48698be351cf08afd9b751dae69aba800bb210fb75e", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains", "Vehicles", "Economy & Finance", "Business & Economy" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "coveredbywise.com", "type": "A", "value": "172.67.161.244" }, { "name": "coveredbywise.com", "type": "A", "value": "104.21.15.79" }, { "name": "coveredbywise.com", "type": "AAAA", "value": "2606:4700:3030::6815:f4f" }, { "name": "coveredbywise.com", "type": "AAAA", "value": "2606:4700:3036::ac43:a1f4" } ], "dnssec_valid": false, "ip": "172.67.161.244", "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-22T12:42:53Z", "updated": "2026-10-22T12:45:47Z", "expires": "2027-10-22T12:42:53Z", "nameservers": [ "charles.ns.cloudflare.com", "molly.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T22:06:23Z", "analysis_at": "2026-10-25T21:53:17Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-22T12:42:53Z", "expires": "2027-10-22T12:42:53Z", "updated": "2026-10-22T12:45:47Z", "first_seen": "2026-10-22T12:55:50Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:f4f" }, { "ttl": 21600, "type": "NS", "value": "charles.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.15.79" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "charles.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "molly.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::ac43:a1f4" }, { "ttl": 300, "type": "A", "value": "172.67.161.244" } ], "dns_at": "2026-10-25T21:59:09Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.coveredbywise.com", "coveredbywise.com" ], "issuer": "Let's Encrypt / YE1", "serial": "60589e715f232f43c2c7028e7d225682d61", "sha256": "5edbaf9fe0838015a39daee3882e3ecb6ec478ac3d0b27cb9d6ae6d1422cca7c", "subject": "coveredbywise.com", "valid_to": "2027-01-20T11:51:34Z", "valid_from": "2026-10-22T11:51:35Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-10-22T12:42:53Z", "updated": "2026-10-22T12:42:53Z", "expires": "2027-10-22T12:42:53Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "charles.ns.cloudflare.com", "molly.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-10-22T12:42:53Z", "registration": "2026-10-22T12:42:53Z", "registrar expiration": "2027-10-22T12:42:53Z", "last update of RDAP database": "2026-10-22T12:42:53Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T22:03:42Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "coveredbywise.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T21:35:35Z", "first": "2026-10-25T21:35:35Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 12062 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://coveredbywise.com/wp-sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 10 }, "social_tags": { "ogUrl": "https://coveredbywise.com/", "title": "Temporary Car Insurance from 1 Hour | CoveredByWise", "ogType": "website", "robots": "max-image-preview:large, index, follow, max-snippet:-1, max-video-preview:-1", "ogTitle": "CoveredByWise – Temporary Car Insurance from 1 Hour", "ogSiteName": "CoveredByWise", "description": "Get temporary car insurance from 1 hour to 30 days. Instant online quotes, competitive prices, and Third Party Only cover. Buy online in minutes.", "twitterCard": "summary_large_image", "canonicalUrl": "https://coveredbywise.com/", "ogDescription": "Need short-term car insurance? Get a quote in seconds and drive legally from just 1 hour. Instant cover, competitive rates. FCA regulated." }, "trackers": { "requests": 17, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 8, "tls": 22, "wait": 582, "connect": 33, "download": 1 }, "response_ms": 646 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 50784, "co2_grams": 0.0019, "cleaner_than": 37 }, "dns_server": { "ns": [ { "ip": "108.162.193.83", "host": "charles.ns.cloudflare.com" }, { "ip": "172.64.32.205", "host": "molly.ns.cloudflare.com" } ], "zone": "coveredbywise.com" }, "cookies": { "cookies": [ { "name": "sbjs_migrations", "session": true }, { "name": "sbjs_current_add", "session": true }, { "name": "sbjs_first_add", "session": true }, { "name": "sbjs_current", "session": true }, { "name": "sbjs_first", "session": true }, { "name": "sbjs_udata", "session": true }, { "name": "sbjs_session" } ] }, "location": { "ip": "2606:4700:3036::ac43:a1f4", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "coveredbywise.com" }, "dns": { "A": [ "104.21.15.79", "172.67.161.244" ], "NS": [ "charles.ns.cloudflare.com", "molly.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"charles.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418182731, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3030::6815:f4f", "2606:4700:3036::ac43:a1f4" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff, nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3036::ac43:a1f4", "family": 6 }, "redirects": { "chain": [ "https://coveredbywise.com" ] }, "subdomains": { "count": 1, "subdomains": [ "www.coveredbywise.com" ] }, "linked_pages": { "internal_count": 13 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-22T12:42:53Z", "updated": "2026-10-22T12:45:47Z", "expires": "2027-10-22T12:42:53Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "charles.ns.cloudflare.com", "molly.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/7.4.33", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff, nosniff", "referrer-policy": "strict-origin-when-cross-origin" } } } } ```