ncg[.]cc

This domain, ncg.cc, is identified as part of a credential phishing campaign designed to impersonate Cloudflare security verification processes. Analysis indicates the infrastructure was engineered to mimic legitimate security prompts, likely targeting users with fake login or authentication requests to harvest credentials. The use of technologies such as Bootstrap, Zepto, and jQuery suggests a polished frontend designed to deceive targets into believing the interaction is authentic. No specific drainer kit signatures were detected, but the presence of HSTS and Cloudflare-related headers implies an attempt to appear legitimate while obfuscating malicious intent. Technical indicators reveal the domain was registered on March 8, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with phishing and fraudulent domains. The domain resolves to the IP address 188.114.96.3, which is part of a network range previously linked to malicious activity. VirusTotal detection metrics show 14 out of 95 security vendors flagging ncg.cc as malicious, while it appears on one additional security blocklist. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection rather than a clean status. The domain's use of HTTP/3 and Cloudflare further complicates attribution and takedown efforts. As of the latest assessment, ncg.cc has been taken offline, likely following abuse reports or registrar intervention. However, the elevated risk level persists due to the domain's recent creation, its association with a high-risk registrar, and its prior resolution to a suspicious IP. Organizations and individuals are advised to monitor for similar domains registered through Gname.com Pte. Ltd. or resolving to 188.114.96.3, as threat actors may reuse infrastructure. End users should verify the authenticity of any security-related prompts, particularly those requesting credentials, and report suspicious domains to relevant security platforms for further analysis.