privetkort[.]com

Analysis on July 31 2026 confirms that the recently registered domain privetkort.com is being used in an active generic phishing campaign. The domain was created on July 26 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points exclusively to the IPv4 address 31.76.118.114, and the authoritative name servers are ns3.my-ndns.com and ns4.my-ndns.com. The domain has been added to one security blocklist and is listed as blocked by the PhishDestroy feed, indicating that at least one downstream protector is already denying traffic.

VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors; none of the scanners reported a detection at the time of analysis, but the absence of a flag does not imply safety. No public information is available regarding SSL/TLS configuration, HTTP response codes, page title, or any observed payload, so the exact phishing landing page remains unknown. The limited visibility means that defenders cannot yet confirm the targeted brand or the specific credential‑harvesting technique, but the registration timing and immediate blocklist appearance suggest a fast‑flux style deployment.

Organizations should proactively block privetkort.com at network perimeter devices, DNS resolvers, and endpoint security solutions. Continuous monitoring of the IP address 31.76.118.114 for additional malicious activity is advised, as well as periodic re‑scanning of the domain with updated URL reputation services. If any user reports suspicious emails referencing privetkort.com, incident responders should treat them as potential phishing attempts and collect relevant headers for further attribution.