cvg67g[.]pics

Analysis of cvg67g.pics indicates a high‑risk, active phishing infrastructure. The domain was registered on July 16, 2026 through Spaceship, Inc. and currently resolves to IP address 47.242.217.10, which geolocates to Hong Kong. No TLS certificate is presented, and the HTTP response returns status 200, suggesting the site is reachable without encryption. The authoritative nameservers are launch1.spaceship.net and launch2.spaceship.net, both consistent with the registrar’s naming scheme. The page title retrieved from the site is "首页", a generic Chinese term for "home page," providing no further context about the targeted brand or service.

The domain is already blocked by the PhishDestroy feed and appears on a single security blocklist, indicating that at least one external threat‑intelligence source has flagged it. VirusTotal reports that 1 of 91 scanning engines flagged the domain, reinforcing the suspicion of malicious activity. While the evidence confirms the presence of a phishing‑related site, details such as the exact phishing kit, targeted victim demographics, or any credential‑harvesting mechanisms remain undisclosed. Defenders should prioritize immediate mitigation by adding cvg67g.pics to network deny lists and web‑proxy block rules.

Continuous monitoring of the associated IP address (47.242.217.10) is advised, as threat actors may reuse the host for additional campaigns. Given the absence of SSL, any traffic to the domain can be intercepted, further increasing risk. Organizations should also monitor for newly observed subdomains under the same registrar and nameserver pair, as they may indicate expansion of the campaign. Regular re‑evaluation of the domain’s status in threat‑intel feeds is recommended to capture any changes in detection counts or blocklist presence.