bento[.]cv

Analysis of bento.cv shows a recently created domain (registered 13 June 2024) that resolves to the IP address 185.12.116.87. The registrar listed is OlaCV Registrar and the authoritative name servers are ns1.dnscpanel.com, ns2.dnscpanel.com, and ns3.dnscpanel.com. The domain has been added to a single security blocklist and is actively blocked by the PhishDestroy sinkhole.

VirusTotal records indicate that the domain was examined by 91 scanning engines; none reported a detection at the time of the scan, but the absence of a positive does not imply benign intent. No public SSL certificate details, HTTP response codes, page title, or brand targeting information have been disclosed, leaving the exact phishing lure undefined. The limited infrastructure footprint—single IP, shared DNS panel, and modest blocklist presence—suggests a low‑profile operation typical of short‑lived phishing campaigns that rely on rapid domain turnover.

Defenders should continue to monitor the IP address 185.12.116.87 for additional malicious activity, enforce blocking of the domain in outbound and inbound filters, and consider adding it to internal threat intelligence feeds. Ongoing observation of the registrar and name‑server patterns may reveal related domains that reuse the same DNS provider. Until further payload or landing‑page evidence is available, the domain remains classified as an active, under‑investigation phishing vector.