thecovnresation[.]comDomain
Reported by 2 independent sources · first reported by Volexity · last reported
Last reported 1 month ago
What the reports say
2 reports, newest first · the exact sentence from each-
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware“Interestingly, CLEANGULP has been found to use a hard-coded domain named "thecovnresation[.]com" for command-and-control (C2) over HTTP, indicating an attempt to mimic "theconversation.com," a non-profit media outlet known for publishing academic research, analysis, and commentary.”
-
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits“This instance of CLEANGULP uses a single hardcoded command-and-control (C2) domain thecovnresation[.]com.”
Indicators reported together
named in the same reports- chinadigitaltimes[.]topin 2 reports
- americanprgoress[.]topin 2 reports
- chinadigitaltimes[.]netin 1 report
- americanprogress[.]orgin 1 report
- 96.9.125[.]52in 1 report
- hxxps://americanprgoress[.]top/chrome_cleanup.exein 1 report
- 177652713dad3c128bd9195abf2b7603in 1 report
- 668aa5551315ab26…8e4560a1e1afin 1 report
- 8858ea412dc306b3…3c2692e603cbin 1 report
- cbeeb7dd5e89261c…ad463ffa8f21in 1 report
- personclouds[.]comin 1 report
- outsourcingwise[.]comin 1 report
- outsourcingwise[.]netin 1 report
- halal-navi[.]comin 1 report
- halal-navi[.]netin 1 report
- halalketak[.]netin 1 report
- halaltak[.]netin 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2026-85046, CVE-2026-85880, CVE-2026-87491
Thanks — we review every report.