povcas[.]com

Analysis of povcas.com confirms its classification as an active phishing domain. Registered on July 4, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to IP address 188.114.96.3. Infrastructure review shows Cloudflare nameservers (andronicus.ns.cloudflare.com, kinsley.ns.cloudflare.com), a common pattern among threat actors leveraging Cloudflare's proxy services to obscure hosting origins.

As of July 22, 2026, the domain appears on one security blocklist (PhishDestroy) and is flagged by 3 of 95 security vendors on VirusTotal, indicating detection by multiple engines despite limited public reporting. The specific phishing campaign or targeted brand remains unconfirmed, as no page title, brand target, or scam type details were provided in available intelligence. The domain's recent registration and immediate detection suggest a short-lived operation typical of credential harvesting or fraudulent login portals.

Defenders should treat this domain as high-risk and implement blocking at DNS, proxy, or endpoint levels. Network logs should be reviewed for connections to 188.114.96.3 or povcas.com, particularly from corporate or high-value user segments. Given the domain's active status and minimal blocklist coverage, additional monitoring is recommended to track potential shifts in infrastructure or campaign focus.