cumcam-ai[.]com

cumcam-ai.com was observed in a single security blocklist and was actively blocked by PhishDestroy. The domain was registered on 27 February 2026 through NiceNIC International Group Co., Limited and does not present an SSL certificate, indicating an unencrypted HTTP service at the time of analysis. DNS resolution points to the IPv4 address 5.255.98.17, which belongs to AS60404 The Infrastructure Group B.V. in the Netherlands. The authoritative name servers are keenan.ns.cloudflare.com and rita.ns.cloudflare.com, both belonging to Cloudflare’s DNS service, suggesting the operator leveraged a third‑party DNS provider to hide the true hosting location.

The page title returned from the site is “CumCam WebApp”, but the site is currently offline, limiting any direct content inspection. VirusTotal reports that one out of ninety‑five scanning engines flagged the domain, providing a minimal but non‑zero detection signal. The presence on a blocklist and the single vendor detection together indicate that the domain has been identified as malicious, likely used for credential harvesting or similar phishing tactics. Because the site is no longer reachable, real‑time payload analysis cannot be performed, and the exact lure or credential‑collection mechanism remains unknown.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host IP or associated Cloudflare name servers, and consider adding the domain to internal threat intelligence feeds. Continuous observation of the registrar NiceNIC International Group Co., Limited for new registrations with similar patterns may help surface future campaigns. The limited public evidence suggests a low‑tech phishing campaign that was taken down promptly, but the underlying infrastructure—particularly the use of Cloudflare DNS and a Netherlands‑based AS—could be reused for other malicious domains.