covert[.]exchange

The domain covert.exchange was registered on April 28, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is presently active, returning HTTP 200 responses. DNS resolution points to IP 188.114.96.3, which belongs to Cloudflare (AS13335) and is located in the United States. The site presents a TLS certificate issued by Let’s Encrypt (identifier YE2) and uses Cloudflare services, including Browser Insights and HTTP/3. Automated analysis identified the page title “Covert | Anonymous Crypto Exchange” and classified the threat as a fake exchange, consistent with the generic_phishing label. VirusTotal reports five of ninety‑one security vendors flagging the domain, while Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one known security blocklist. PhishDestroy has already blocked the site. The infrastructure uses the Cloudflare nameservers gloria.ns.cloudflare.com and yichun.ns.cloudflare.com. Current evidence confirms the domain’s malicious intent but provides limited visibility into the underlying payload or credential‑harvesting mechanisms. Defenders should add covert.exchange to network and endpoint blocklists, monitor DNS queries for the associated IP address, and enforce TLS inspection to detect any potential data exfiltration. Ongoing surveillance of the domain’s activity and any related sub‑domains is recommended to capture future changes in the phishing campaign.