cashmerevassist[.]icu

Analysis of cashmerevassist.icu shows a high‑risk generic phishing infrastructure that remains active as of 12 July 2026. The domain was registered on 3 May 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the Cloudflare‑owned address 188.114.97.3, located in Canada. DNS is hosted on Cloudflare name servers (asa.ns.cloudflare.com, margo.ns.cloudflare.com) and the site presents a TLS certificate from Let’s Encrypt (E8). An HTTP request returns a 403 status code and the page title is "Just a moment...", indicating that the landing page content has not been publicly indexed. The domain is listed on one security blocklist, has a Gridinsoft trust score of 0/100, and appears in a single AlienVault OTX pulse. Four of ninety‑one VirusTotal scanners flagged the site as malicious, and PhishDestroy has already blocked it. While the exact credential‑harvesting payload has not been captured, the combination of recent registration, Cloudflare hosting, low trust score, and multiple vendor detections supports a high confidence rating for phishing activity. Defenders should add cashmerevassist.icu to URL filtering and DNS blocklists, monitor for related C2 IP activity, and update intrusion‑detection signatures to include the observed IP and TLS fingerprint. Continuous re‑evaluation is advised if the site begins serving content beyond the current 403 response.