covesting-cc[.]cc

Analysis of the domain covesting-cc.cc shows a recently registered infrastructure that is actively used for phishing. The domain was created on July 01, 2026 and is hosted under a Let's Encrypt certificate (YR2) that was issued to the same name, indicating a valid TLS endpoint. DNS resolution points to the single IPv4 address 206.119.189.9, and the domain is served by three authoritative name servers (ns1.dnsowl.com, ns2.dnsowl.com, ns3.dnsowl.com) listed under the NameSilo, LLC registrar. VirusTotal has recorded detections from 2 of 91 security vendors, suggesting that at least a small subset of scanners have identified malicious activity associated with the host. The domain also appears in one AlienVault OTX pulse, reinforcing its presence in threat‑intel feeds. The classification provided is generic_phishing with a high risk rating, and the domain remains active as of the report date. No additional content analysis (page title, brand targeting, or phishing kit details) is available, leaving the exact payload or luring technique undefined. Defenders should prioritize blocking DNS resolution and HTTP/HTTPS traffic to 206.119.189.9 and to covesting-cc.cc, incorporate the domain and its IP into intrusion detection signatures, and monitor for any new indicators that may emerge from subsequent sandbox or sandbox‑type analyses. Continuous threat‑intel correlation is advised to capture any future expansions of the campaign.