kassu[.]site

The domain kassu.site was registered on 2025-12-09 through NameCheap, Inc. and is currently served from the IP address 185.199.111.153, which belongs to AS54113 Fastly, Inc. in the United States. The authoritative nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com, and the MX record points to eforward1.registrar-servers.com (priority 10). An HTTPS connection presents a valid Let’s Encrypt R12 certificate, a common choice for both legitimate and malicious sites. The web server returns HTTP 200 and the only observable page title is "Ginkeli SIUUU", a string that does not map to any known brand or service, suggesting the page is unlikely to be a legitimate business page.

Technology fingerprinting shows the presence of YouTube embeds, Varnish caching, Fastly CDN, and GitHub Pages, a combination frequently observed in phishing infrastructure that leverages free hosting and CDN services to hide origin. The domain appears on two independent blocklists (PhishDestroy and ScamSniffer) and is listed as active on both. VirusTotal analysis shows that 2 of 93 security vendors have flagged the domain as malicious, providing additional independent corroboration of suspicious activity. Gridinsoft assigns a trust score of 0/100, reinforcing the low reputation.

While the page content has not been publicly archived, the convergence of a recent registration, active blocklist listings, vendor detections, a generic page title, and the use of free hosting services constitutes a strong indicator of a phishing operation. Defenders should consider adding kassu.site to deny-list controls at the network perimeter, DNS filtering, and endpoint web-filter policies. Ongoing monitoring of the domain’s DNS resolution, TLS certificate renewal, and any new detections on threat-intel platforms is recommended to capture potential escalation or reuse of the same infrastructure for additional campaigns.