girisinadrssi-casibom[.]vip

Analysis of girisinadrssi-casibom.vip shows a newly registered domain (created 21 Feb 2026) that is actively serving a phishing page titled “Hawkins & Clarke | Global Asset Recovery Division”. The site is hosted behind Cloudflare’s network (ASN 13335, IP 188.114.97.3, United States) and uses Cloudflare‑provided DNS (newt.ns.cloudflare.com, wren.ns.cloudflare.com). SSL termination is performed by Google Trust Services (certificate issued by WE1), indicating a valid TLS certificate despite the malicious intent. The HTTP response code 521 suggests the origin server is refusing connections, a pattern often observed with Cloudflare‑protected phishing sites.

Reputation data shows the domain appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100. VirusTotal reports six of ninety‑three scanners flagging the domain, providing additional corroboration of malicious behavior. The page incorporates third‑party libraries such as jsDelivr and leverages HTTP/3, which does not affect the threat assessment but confirms modern delivery mechanisms.

Registration was performed through NiceNIC International Group Co., Limited, a registrar known to host abusive domains. No further technical artefacts such as malware hashes or C2 infrastructure have been released, leaving the full scope of the campaign uncertain. Defenders should block the domain at perimeter firewalls and DNS resolvers, monitor for outbound connections to the associated Cloudflare IP range, and add the domain to internal phishing blocklists. Continuous re‑evaluation is advised, as the underlying server may become reachable if Cloudflare configuration changes, potentially enabling credential‑stealing forms or additional payload delivery.